CFIUS proposes export control-based reforms to its mandatory filing program

On May 21, 2020, the Treasury Department published a proposed rule to change the mandatory filing requirements in the regulations governing the Committee on Foreign Investment in the United States (CFIUS).  The most significant change is that mandatory filings for transactions involving critical technologies would no longer be determined by reference to whether a company is engaged in or designing products for use in certain industries identified by reference to the North American Industry Classification System (NAICS).  The proposed rule instead bases the requirement for filing a mandatory declaration on a complex assessment of the applicable export control licensing requirements for the critical technologies involved in the transaction.[1]

CFIUS published this rule in apparent response to public comments on the CFIUS regulations that became effective on February 13, 2020 that the NAICS code system was imprecise and difficult to apply.  Shifting away from the relatively subjective NAICS code assessment, the rule would now be based on the national security foundations of established export control regimes.  Investors from excepted foreign states, FOCI-mitigated entities as well as investment funds managed exclusively and ultimately controlled by US nationals will continue to be excluded from the filing requirement.

The Treasury Department is accepting comments on the proposed rule until June 22, 2020.  The existing mandatory filing regulations will continue to apply to transactions where parties have executed a binding written agreement establishing the material terms of the transactions before the effective date of the final rule, and the Pilot Program Interim Rule will continue to apply to transactions that closed between November 10, 2018 and February 13, 2020.

Export control licensing replaces NAICS codes for mandatory filing analysis

Under the existing CFIUS regulations, parties to a covered transaction are required to file a declaration (or may opt to file a notice) if the transaction involves a US business that produces, designs, tests, manufactures, fabricates or develops one or more “critical technologies“ that are either used by the US business in, or designed specifically for use in, one of 27 industries identified by their NAICS code.  Under the proposed rule, the filing requirement would continue to apply to both controlling transactions and “covered investments” (ie, non-controlling investments that afford the foreign person access to material non-public technical information, board director or observer rights, or substantive decision-making power), and the definition of “critical technologies”[2] would not change.  However, parties would instead be required to make a CFIUS filing in connection with foreign investment in a US business that produces, designs, tests, manufactures, fabricates or develops “critical technologies” that would require “US regulatory authorization” to provide the technology to the foreign investor.

Specifically, a CFIUS filing would be required if any of the following US regulatory authorizations would be necessary to export, re-export, transfer (in-country) or retransfer the critical technology to any foreign person involved in the transaction:

• A license or other approval (eg, technical assistance agreement) issued by the Department of State under the International Traffic in Arms Regulations (ITAR)
• A license from the Department of Commerce under the Export Administration Regulations (EAR)
• A specific or general authorization from the Department of Energy under the regulations governing assistance to foreign atomic energy activities at 10 CFR part 810, except the general authorization at 10 CFR § 810.6(a) for the export of certain controlled nuclear technology to specified countries or entities or
• A specific license from the Nuclear Regulatory Commission under the regulations governing the export or import of nuclear equipment and material at 10 CFR part 110.

Assessing US regulatory approval requirements

US regulatory approval requirements relevant to the proposed CFIUS rule are largely based on (1) the export classification of the critical technology and limited applicable license exceptions, and (2) the nationality of the recipient.  Under the proposed rule, parties to a covered transaction would have to evaluate the licensing requirements for all critical technologies that a US business produces, designs, tests, manufactures, fabricates or develops.  If even only one critical technology requires a license for export to any of the foreign persons involved in the transaction, under the parameters below, then a CFIUS filing would be mandatory.

1.  Export classification and license exceptions

Understanding the export classification regimes under the ITAR and EAR is a critical component of the proposed mandatory filing analysis.  Not only would the classification determine whether the products, software or technologies involved in the transaction are “critical technologies,” but the classification would also drive the potential licensing requirements and applicable license exceptions, and thus the mandatory CFIUS filing obligation.

Under the proposed rule, only three exceptions under the EAR may be considered in evaluating the applicable export licensing requirements.  Specifically, products, software or technologies that are eligible for the following license exceptions would not trigger a mandatory filing:

License Exception Technology and Software Unrestricted (TSU) (15 CFR 740.13) – authorizes the provision of limited software updates, sales technology and low-level operation technology and software to certain destinations and end users.

License Exception Encryption Commodities, Software, and Technology (ENC) (15 CFR 740.17(b)) – authorizes the export to certain categories of end users of most standard and some non-standard encryption source code and certain other cryptographic commodities, software and components for use in network infrastructure.  The current CFIUS regulations exempt encryption technology that is eligible for any part of License Exception ENC, but the proposed rule narrows that exemption to include only those items eligible for export under the authority of subpart (b) of License Exception ENC.  Subpart (b) includes a self-classification provision for certain eligible items and mandatory written review by the Bureau of Industry and Security for others.  Thus, companies that have not classified their technology and products under License Exception ENC may lose the opportunity to invoke this exemption.

License Exception Strategic Trade Authorization (STA) (15 CFR 740.20(c)(1)) – authorizes the provision of items subject to certain controls to a limited set of destinations that are considered to pose a lower risk of unauthorized or impermissible end uses.[3]

All aspects of these license exceptions must be satisfied to relieve the declaration requirement, including the foreign person’s eligibility to rely on the exception.  Notably, other export license exceptions, such as License Exception TSR (technology and software under restriction) that may be available under the EAR for the technology at issue, are not to be considered when assessing the export licensing requirements for purposes of the CFIUS mandatory filing.

2.  Nationality assessment of the foreign person

Under the proposed rule, all foreign parties to a covered transaction – ie, parties directly acquiring a controlling or covered non-controlling interest, or obtaining certain new rights in the US business – must be considered as “end users” in determining whether a US regulatory approval is required to export the critical technology.  Additionally, any foreign person that has a direct or indirect voting interest of 25 percent or more in a foreign party to the transaction must be considered.  In the case of an investment fund, that assessment would include the nationality of individuals or entities holding a 25-percent or more interest in the general partner, managing member or equivalent of the fund.  The interests of multiple foreign persons must be aggregated when assessing application of the rule if the foreign persons are related, have formal or informal arrangements to act in concert, or are agencies or instrumentalities of, or controlled by, the national or subnational governments of a single foreign state. 

A foreign person’s country of origin is determined by its nationality (for individuals), or principal place of business (for entities).  Principal place of business is defined as the primary location where an entity’s management directs, controls or coordinates the entity’s activities.[4]  In the case of an investment fund, the principal place of business is the primary location where the fund’s activities and investments are directed, controlled or coordinated by or on behalf of the general partner, managing member or equivalent.

Practical impact of the proposed modifications

The proposed rule is likely to improve CFIUS’s ability to focus on technologies that have already been identified by the US government as requiring a license or authorization based on an analysis of a critical technology and the end user, as well as the destination country.  The proposed changes also eliminate imprecision in the use of NAICS codes in the analysis, particularly with respect to whether a US business is engaged in or designing critical technology specifically for a listed industry.  It is unclear whether these proposed modifications will change the number of transactions subject to the CFIUS mandatory declaration requirement.

The changes may increase the burden on some US companies considering foreign investment, as it will require them to evaluate export controls in earnest.  Given that many early stage companies have not definitively evaluated the export control classifications for their products, the analysis of whether the US business is engaged in or designing products specifically for one of the 27 industries identified by their NAICS code in the existing regulations could sometimes be a more efficient way to determine whether a CFIUS filing is mandatory.  Under the proposed rule, that would no longer be an option.  Although the short-form declaration process provides a faster alternative to a full notice filing, even the 30-day review period (plus preparation and filing time) might delay the speed at which many investments would otherwise close – particularly in the venture capital space.  Thus, to avoid timing issues should a mandatory filing be required under the proposed rule, companies that anticipate foreign investment would be best positioned to consider export controls at as early a stage as possible.

Further assistance

DLA Piper maintains a robust, cross-disciplinary CFIUS practice consisting of corporate, regulatory, and government affairs professionals. Please feel free to contact any of our CFIUS attorneys below should you have any questions.

Christine Daya

Thomas M DeButts

Danish Hamid

Sarah E. Kahn

Nicholas Klein

Richard Newcomb

Ignacio E. Sanchez

Lawrence E. Levinson

[1] The proposed rule also clarifies the definition of “substantial interest” as that term is used in evaluating mandatory filing requirements for foreign government-controlled transactions.  However, that clarifying amendment is not the subject of this alert.

[2] Critical technologies are defined to include (i) defense articles and defense services included on the U.S. Munitions List of the ITAR; (ii) items included on the Commerce Control List of the EAR and controlled for specified reasons; (iii) items related to assistance to foreign atomic energy activities; (iv) nuclear facilities, equipment and material covered; (v) select agents and toxins; and (vi) emerging and foundational technologies that will soon be controlled pursuant to the Export Control Reform Act of 2018.

[3] If the technology is eligible, License Exception STA in this case would provide filing exemptions for investors from countries included in Country Group A:5 in the EAR.

[4] The definition of “principal place of business” was implemented pursuant to an interim rule that has not yet been finalized.