The Impact of CFIUS on Private
Equity and Hedge Fund Investors

On Feb. 13, 2020, final regulations became effective updating and refining rules regarding transaction reviews by the Committee on Foreign Investments in the United States (CFIUS).^[i] These regulations, which until now have been in interim form, implement the previously enacted Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA). Together with FIRRMA, the new regulations significantly expanded the authority of CFIUS to a much broader range of transactions and investments. FIRRMA may have been motivated by heightened concerns over acquisitions involving foreign government-associated purchasers, particularly involving China, and the prevention of security-related critical technologies falling into the hands of hostile state actors. But the broad reach of the statute and regulations, especially given their complexity and the absence in many cases of a clearly defined scope of application, has the potential to affect a wide swath of transactional actors. These include private equity firms and hedge funds that count foreign nationals and foreign governmental entities among their investors. The recent effectiveness of the new regulations offers a timely opportunity to review the impact that CFIUS and its filing and review procedures are likely to have on these funds and their investors.

Overview

CFIUS is an interagency federal government consortium that reviews transactions that may result in foreign actors having a controlling interest in, or having significant involvement with, U.S. businesses engaged in activities relating to critical technology, critical infrastructure or sensitive personal data (TID U.S. Businesses) or obtaining control of real estate (broadly defined, but excluding commercial development, such as office parks and multifamily housing) in the vicinity of certain vital U.S. installations (covered real estate).

The regulations provide for limited instances in which investors must make a mandatory submission for CFIUS review, as discussed below. However, CFIUS has a much broader scope of jurisdiction. If a transaction involves a TID U.S. Business, and a voluntary submission has not been made, CFIUS may initiate its own review, either pre-or post-closing, notwithstanding that no mandatory filing was required. There are no size parameters limiting CFIUS review, and CFIUS has the power to exact substantial fines for violations of its rules. CFIUS may recommend to the president that he or she reject or rescind any transaction that it reviews.

Private equity and hedge funds often have foreign investors that, through their ownership interest in the fund, indirectly participate in the fund’s acquisition or investment activities, including those that could fall within CFIUS’ jurisdiction. Understanding the acquisition or investment activity that is subject to CFIUS review, so as to make an informed decision on whether a filing is required or advisable early in the process, can avoid unnecessary process delay and potential transaction failure. Also, through proper structuring, funds may be able to take in foreign investment without implicating CFIUS review. In any event, any potential transaction involving direct or indirect foreign investment in or significant involvement with a U.S. enterprise should merit careful scrutiny to assess the potential for CFIUS review.

Transactions coming within the jurisdiction of CFIUS

A transaction comes within the jurisdiction of CFIUS if it:

• Would result in control of a TID U.S. Business by a foreign person (a covered control transaction);
• Affords a foreign person access to material nonpublic technical information of (including through board membership or observer rights) or involvement in a TID U.S. Business (a covered investment);
• Changes the rights of foreign persons so as to result in a covered control transaction or a covered investment; or
• Provides a foreign person with access to, or development rights with respect to, covered real estate.

“Control” is broadly defined as the power to directly or indirectly determine, direct or decide important matters affecting an entity. This can take the form of equity ownership, contractual rights or other arrangements. Examples of important matters for these purposes include merger and acquisition-related activity, major expenditures, debt or equity issuances, significant contracts, management issues, or changes to constituent documents. Certain rights of negative control, however, are not regarded as conferring control. These include rights to prohibit the sale of the assets or equity of an entity or prevent the filing for bankruptcy or liquidation, veto rights over affiliated party transactions, antidilution protections, and actions to protect the preferences of preferred equity.

The definition of a TID U.S. Business

The definition of a TID U.S. Business to which CFIUS jurisdiction attaches is complex and in many respects lacks bright lines. While the components of the definition may be summarized, their application to particular businesses will often require detailed examination and consideration. In brief, TID U.S. Businesses include:

• Critical Technology. U.S. businesses that produce, design, test, manufacture, fabricate or develop one or more “critical technologies.” These technologies include a broad range of defense-related technologies; technologies covered by certain export controls under multinational regimes relating to regional stability; certain nuclear technologies, facilities, agents and toxins; and emerging and foundational technologies controlled under the Export Control Reform Act.
• Critical Infrastructure. U.S. businesses involving systems or assets so vital to the United States that their incapacity or destruction would have a debilitating effect on national security. Examples are certain telecommunications and information services, submarine cables, internet infrastructure, satellite systems, certain specified metals, electricity transmission systems, oil and gas extraction, refineries, storage and distribution infrastructure, pipelines, financial market facilities, rail infrastructure, and certain public water systems. An appendix to the CFIUS regulations details the functions a business must perform with regard to “critical infrastructure” in order to be considered a TID U.S. Business.
• Sensitive Personal Data. U.S. businesses that maintain or collect, directly or indirectly, “sensitive personal data,” which is personally identifiable data broadly characterized as data that is aimed for use by the executive branch or the military, as well as broadly collected personally identifiable data for government identification purposes. Among other things, this category includes (i) data that is customized or actively marketed to the U.S. executive branch agencies or military departments with national security, intelligence or homeland security responsibilities, or their personnel or contractors, and (ii) genetic, geolocation or biometric data, certain physical or financial health data, security clearance data, and data stored for government identification purposes, if collected or maintained covering more than one million individuals.

Given the absence of investment size parameters and the broad focus on critical technologies, infrastructure and data, the scope of transactions to which CFIUS review is potentially applicable has exponentially expanded. Even startup companies that focus on advanced technologies or personally intrusive data collection or management can be drawn into the CFIUS web.

Real estate subject to CFIUS

Covered real estate whose acquisition may now be subject to CFIUS review generally includes real estate that is:

• Located within or functioning as part of a maritime port or an airport;
• Located within close proximity of military installations and certain other government facilities;
• Located within an extended range of certain military installations; or
• Part of certain military installations located within the territorial seas of the United States.

Certain exemptions from CFIUS review

CFIUS’ authority to review transactions involving TID U.S. Businesses rests on the possibility that the transactions could give rise to control over, access to information of or involvement with the TID U.S. Business by a foreign person. However, the CFIUS regulations provide certain exemptions, which, while strictly applicable only to mandatory filings, suggest circumstances in which the presence of foreign investors in a transaction will not raise concerns of a CFIUS review regardless of whether review is mandatory. Certain of these exemptive criteria, described below, are specifically directed toward entities such as private equity and hedge funds.

Acquisitions and investments by a fund organized under the laws of the United States or certain “white listed” foreign countries (excepted foreign states) and having its principal place of business in the United States or in an excepted foreign state will not be deemed a covered control transaction or a covered investment if:

• 75% or more of the members, governing body or observers are U.S. nationals or nationals of an excepted state; and 
• All holders of 10% or more of the economics or voting power or other controlling indicia of the fund are U.S. nationals or nationals of an excepted foreign state.

Funds that satisfy these criteria are regarded as “excepted investors,” notwithstanding that they may have foreign investors. Currently, the only countries that qualify as excepted foreign states are the United Kingdom, Canada and Australia.

An investment by a foreign person through a private equity or hedge fund (an investment fund) will be exempted with respect to covered investments (but not covered control transactions), if:

• The fund has no more than 100 investors (as calculated under Section 3(c)(1) of the Investment Company Act of 1940) or all its investors are qualified purchasers (as provided in Section 3(c)(7) of the Investment Company Act);
• The fund is exclusively managed by a managing member, general partner or the equivalent who is not a foreign person, and the managing person or entity has exclusive management power;
• If a foreign investor is on the advisory board or a committee of the fund, the advisory board or committee cannot have the ability to approve, disapprove or control investment decisions or decisions of the fund manager, or have the unilateral right to effect the dismissal or compensation of the manager; and 
• Foreign investors do not have access to material nonpublic technical information of a TID U.S. Business in which the fund is invested.

The CFIUS review process

Reviews by CFIUS are triggered either by mandatory or voluntary submissions (referred to in the regulations as “declarations”). CFIUS can also initiate a review on its own initiative.

The final rules limit mandatory submissions to a small subset of transactions. Mandatory submissions are required only for the following types of activity:

• Acquisition of a TID U.S. Business. A transaction in which (i) a foreign person (ii) controlled by a national or subnational government (the latter being generally defined as a state, regional or local government) (iii) of a single foreign state (iv) has a substantial interest (for these purposes, defined as at least 49% of the direct or indirect voting rights or controlling the general partner of a partnership or managing member of a limited liability company) in the acquirer and (v) the acquisition would result in the acquirer having a substantial interest (for these purposes, defined as at least a 25% interest) in a TID U.S. Business.
• Investment in a TID U.S. Business Engaged in Certain Critical Technologies. A covered investment within one of 27 broadly defined industry groups currently set forth in an appendix to the new regulations, reproduced below in the endnote.^[ii] (These categories are likely to change over time.)
• Covered Real Estate. A transaction involving covered real estate that affords a foreign person three of the following four property rights: (i) access, (ii) the right to exclude access, (iii) development rights and (iv) the right to erect structures.

Other types of acquisitions and investments in a TID U.S. Business subject to CFIUS jurisdiction may be reported voluntarily. The decision to submit a voluntary CFIUS declaration will require a subjective analysis of the risk profile of the particular transaction, taking into account the nature of the acquirer, the sensitivity from a national security perspective of the business, the uniqueness of the goods and services produced or supplied by the business, and the size and scope of the transaction. There are few bright lines.

Submissions, whether mandatory or voluntary, can inject material delay into the transaction timetable and add a measure of risk that the transaction will not be consummated or that significant modifications to the transaction will be required. Also, filings are burdensome and detailed. There is at least a 30-day assessment period once a submission is accepted by CFIUS as complete. CFIUS has formal and informal ways to extend the review period if its staff requires more time to complete their assessment. CFIUS may also require the parties to enter into arrangements to mitigate any issues that CFIUS determines raise national security concerns.

CFIUS can impose substantial monetary penalties for failure to make a mandatory filing, or to provide requested information, up to the size of the transaction. If parties do not make a voluntary declaration and CFIUS determines on its own to review the transaction, there will be no penalty for failure to file, but the parties may find that their transaction timetable has been significantly upended or, if the transaction has been consummated, they may be threatened with rescission.

Application to private equity and hedge funds

The threshold question in a CFIUS analysis for a private equity or hedge fund will be whether the fund has, directly or indirectly, taken in investors that are foreign nationals or foreign governmental actors. If the answer is in the affirmative, the fund will have to consider whether it can take advantage of the excepted investor or investment fund exemptions. Indeed, funds that see themselves as potentially conducting acquisition or investment activity relating to TID U.S. Businesses, or that have the potential to acquire covered real estate, may wish to structure the investments they take in from foreign investors generally so as to take advantage of the exemptive rules.

If a fund has foreign investors and cannot take advantage of the excepted investor or the investment fund exemptions, the next step in its CFIUS decision tree will be to evaluate whether the transaction under consideration falls within the scope of CFIUS’ jurisdiction. Some transactions clearly will not, such as the acquisition of a domestic food processor or clothing retailer. For acquisitions such as these, there will be no reason to evaluate the possible applicability of CFIUS review, irrespective of the foreign complexion of the fund’s investor base. Acquisitions and investments in other industries, such as the regulation-listed TID U.S. Businesses requiring mandatory filings, will leave little room for doubt regarding the applicability of the CFIUS regime. Transactions in other industries and businesses may fall into a grey area.

In situations where CFIUS jurisdiction is implicated but no mandatory filing is required, funds will have to carefully consider whether to submit a voluntary declaration. Together with their legal and other advisors, they will have to weigh the financial and transactional costs associated with a filing — and the delay that it could inject into the deal timeline — against the disruption to the transaction that could follow if CFIUS were to determine on its own to review the transaction late in the process, or even after the transaction has closed. In addition to the factors recited above, the decision whether to file could be informed, for example, by such considerations as whether there are other regulatory milestones and approvals that must be satisfied in any event prior to consummation. And perhaps most important, the fund and its counterparty will need to consider the degree to which the proposed acquisition or investment presents a substantive issue that is likely to attract national security concerns in a CFIUS review.

Conclusion

With the passage of FIRRMA, CFIUS joins the list of legal regimes, such as anticompetition laws, that private equity and hedge funds will now have to consider in planning and structuring their transactional activity. The scope of CFIUS jurisdiction is broad, and any transactional activity in which foreign persons or entities may be deemed to indirectly participate by virtue of their investment in a fund merits careful review. It may be wise, if a fund intends to take in foreign investors and anticipates acting within the jurisdiction of CFIUS, for the fund to structure itself so as to qualify for the exemptive rules. In all events, timely consideration of the relevant issues and close coordination with legal and other advisors will be required to assure compliance with the new CFIUS regime and to avoid disruption of the deal process.

^[i] _{See 85 FR 3112 (Jan. 17, 2020); 31 CFR 800 and 31 CFR 801.}

^{[ii] Industry groups in which a covered investment is subject to mandatory filing with CFIUS:}