By Case Collins
Traditionally, the primary focus of the Committee on Foreign Investment in the United States (“CFIUS”) has been on acquisitions of U.S. companies, largely by Chinese acquirers. However, the adoption of the Foreign Investment Risk Review Modernization Act (“FIRRMA”) in 2018 and the implementation regulations which followed expanded CFIUS’s jurisdiction over non-controlling minority investments in U.S. companies. As a result of its broader jurisdiction, CFIUS has increasingly focused on smaller venture-capital type investments. Therefore, start-ups seeking foreign investment should have a basic understanding of CFIUS, when CFIUS filings may be required, and CFIUS-related deal terms in the standard National Venture Capital Association (“NVCA”) form financing documents.
Overview of CFIUS
CFIUS is an interagency committee that reviews certain “covered transactions” that could result in control of a U.S. business by a foreign investor. In connection with its review, CFIUS advises the President on potential nation security concerns arising from the transaction. The President is authorized to suspend or prohibit any covered transaction where there is credible evidence, in the President’s judgment, to believe that the foreign investor might take action that threatens to impair national security. FIRRMA expanded the scope of “covered transactions” to include smaller non-controlling investments in U.S. business involving specified “critical technology”, “critical infrastructure” or “sensitive personal data” of U.S. citizens (“TID U.S. Businesses”) that afford the foreign investor (i) a board or observer seat, (ii) access to material non-public technical information, or (iii) the ability to participate in substantive decisions regarding critical technology, critical infrastructure or sensitive personal data (together with “control” of a TID Business, “DPA Triggering Rights”).
“Critical technology’ includes technology subject to U.S. export controls, other than dual-use goods. “Sensitive personal data” – which is broader than what would normally be considered as such under certain privacy and data breach laws – includes “identifiable data” that (i) targets or tailors products or services to certain U.S. agencies or military departments, or to their employees or contractors, or (ii) falls within one of the following ten categories: (1) financial data that could be used to determine financial distress or hardship, (2) credit report information, (3) data in an applications for certain kinds of insurance, (4) health information, (5) non-public electronic communications, including email, messaging, or chat communications, (6) geolocation data, (7) biometric data, (8) data used for the creation of government identification, (9) data related to security clearance status, or (10) data in applications for a security clearance.
Start-ups and emerging companies seeking foreign investment should consider whether such investment would fall within CFIUS’s purview. However, just because a transaction could be reviewed by CFIUS does not mean that it will be prohibited by the President or even reviewed by CFIUS. In fact, it is quite common for parties to investments that fall within CFIUS’s scope to determine that the risk of review is minimal and proceed with the transaction.
Mandatory Filings
While participation in the CFIUS review process has been historically voluntary, FIRRMA established mandatory declaration filings for certain investments. A mandatory filing is required where (i) a foreign investor either acquires DPA Triggering Rights over a U.S. business that produces, designs, tests, manufactures, fabricators or develops “critical technologies” and, subject to applicable exceptions, an export license or other authorization would be required to export the target company’s “critical technologies” to the foreign investor’s (or any entity that directly owns 25% or more of the investor) country(ies); or (ii) a foreign investor where a foreign government, directly or indirectly, holds a 49% or greater interest acquires a 25% or greater interest, directly or indirectly, in a TID U.S. Business. The mandatory declaration is a five page or less filing that is an alternative to a formal written notice filing, and includes information on the foreign investor, the target company, and the size, timing, and governance rights implicated by the transaction. The mandatory declaration must be filed at least 30 days prior to the expected closing date of the transaction. Failure to submit a mandatory filing could result in penalties up to the value of the transaction.
In the event the parties to a transaction determine that a mandatory filing is necessary, the parties should consider whether to proceed with a declaration filing or proceed with a full notice filing. In response to a declaration filing and within 30 days, CFIUS may (i) clear the transaction on the basis of the declaration, (ii) inform the parties that CFIUS is unable to conclude the action, but not request or initiate a notice filing, (iii) request that the parties file a notice, or (iv) initiate a notice filing. If the parties decide to file a declaration and CFIUS initiates or requests that parties a notice filing, the parties will have delayed the notice filing up to 30 days.
CFIUS Related Deal Terms
The NVCA released updates to its model legal documents for use in venture financing transactions in September of last year. A major part of this update was aimed at addressing CFIUS risk in venture financing transactions. The NVCA forms include representations and covenants by the company and the investors to confirm that CFIUS mandatory filing criteria are not met and that foreign investor would not obtain any rights that would trigger CFIUS jurisdiction. These include (i) representations by the target company that it is not a TID Business, (ii) covenants by the target company that it will not provide any foreign person with a voting interest that exceeds 9.9% or any DPA Triggering Rights, (iii) representation by investors to that they are not “foreign persons”, and (iv) covenants by investors to notify the Company in advance of permitting any foreign person affiliated with such investor from obtaining DPA Triggering Rights.
Start-ups and emerging companies should understand that representations and covenants merely assign liability to one party or another and are not a defense to CFIUS review. For example, in the event a foreign investor relies on a company’s representation that it is not a TID Business, but at a later point in time CFIUS decides to review the transaction, the company will have breached the agreement and thus be potentially liable for the damages incurred by the investor in connection with the CFIUS review, including any required divestiture. As such, due diligence is necessary to support any such CFIUS representations, including analysis of relevant export classifications and applicable license exceptions. In practice, however, many start-ups are not prepared to do this analysis themselves, and thus may need to engage a trade or export consultant or advisor for assistance with this analysis. Furthermore, companies should be aware that the covenants in the NVCA forms could potentially limit their ability to raise future fundraising from foreign investors, and as such should be carefully deliberated.
An alternative to the NVCA representation approach would be for the parties to address CFIUS-related risks in due diligence and determine whether to include a provision requiring a CFIUS filing in the agreement while not including any representations that allocate liability. This is likely the more company-friendly approach, as the risk of CFIUS review is largely upon the foreign investor, who may potentially be required to divest or give up certain governance rights, as opposed to the company, which will not be required to return any investment funds received post-closing. Additionally, an early stage company may not want to incur the expenses associated with conducting the required analysis to support the CFIUS related representations, such as retaining a trade or export consultant.
Conclusion
Following FIRRMA, CFIUS has increasingly focused on foreign venture capital type investments. As such, start-ups and emerging companies seeking foreign investment should consult with their attorneys on the impact of CFIUS on any such transaction.