KEY TAKEAWAYS

• On January 17, 2020, the US Department of the Treasury published two rules to finalize and implement FIRRMA’s expansion of CFIUS jurisdiction over certain non-controlling investments and certain real estate transactions. The two rules take effect on February 13, 2020.

• The final rules are largely the same as the proposed rules issued in September 2019 focusing on non-controlling investments in Technology, Infrastructure, and Data (TID) US businesses and real estate transactions involving sensitive locations, with some notable changes:

- Inclusion of an interim rule adding a definition for ‘principal place of business’ (primarily to provide clarity regarding CFIUS’s jurisdiction over transactions by investment funds) that is effective February 13, 2020, and open to public comment until February 18, 2020.

- Addition of examples to multiple provisions to provide more clarity for how CFIUS expects parties to apply the regulations.

- Incorporation of many provisions of the ‘Pilot Program’ on critical technologies (31 CFR part 801), to include the mandatory filing requirement for certain covered transactions involving certain US businesses engaged in critical technologies.

- Adjustment of the Pilot Program’s applicability such that it applies only to transactions for which specified actions were taken prior to the effective date of this rule.

• To implement FIRRMA’s requirement for CFIUS to limit the application of its expanded jurisdiction with respect to certain categories of foreign persons, CFIUS has identified Australia, Canada, and the United Kingdom as excepted foreign states, thus limiting the application of the ‘excepted investor’ concept to foreign persons with ties to those three foreign states.

• The final rules do not change CFIUS’s existing jurisdiction over transactions that could result in foreign control of a US business.

I. FINAL REGULATIONS BACKGROUND AND OVERVIEW

On January 13, 2020, the US Department of the Treasury (Treasury) announced its intent to publish two final rules to implement the Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA). The rules were published in final form on January 17, 2020 with an effective date of February 13, 2020.

The final rules have been nearly two years in the making to amend the regulations set forth in parts 8001 and 8012 of title 31 the Code of Federal Regulations (the

CLIENT ALERT

‘Firrmed’ Up at Last – Treasury Publishes Final Regulations to Implement FIRRMA

1 Since its implementation in November 2008, 31 CFR part 800 has addressed CFIUS jurisdiction over transactions that could result in foreign control of a U.S. business.2 In accordance with FIRRMA requirements, 31 CFR part 801 was introduced in October 2018 to temporarily implement a pilot program to expand CFIUS jurisdiction over, and

establish mandatory declarations for, certain non-controlling investments by foreign persons in certain U.S. businesses.

INSIGHTS

CFIUS regulations). As detailed in previous Ankura alerts (June 18, 2018; October 17, 2018; and January 14, 2019), heightened national security concerns culminated in Congress’s passage of FIRRMA in August 2018 and the subsequent issuance of interim regulations in October 2018 via a Pilot Program in connection with US businesses involved in emerging and foundational technologies. FIRRMA significantly expanded the jurisdiction and resources of CFIUS, and the Pilot Program was intended to address the perceived growing threat of foreign direct investment (FDI) in certain industries being exploited for purposes harmful to US national security.

In September 2019, Treasury published for public comment two proposed regulations to implement the balance of FIRRMA in the CFIUS regulations. The regulations in final form, published on January 17, 2020, are the result of CFIUS’s review and response to public comments. Although the finalized regulations maintain many of the provisions included in the proposed regulations, there are a few substantive changes that are discussed below.

As in the September 2019 proposed regulations, the first rule finalizes revisions to part 800 of the CFIUS regulations and is focused on certain non-controlling investments in TID US businesses. It also incorporates provisions of the Pilot Program into part 800 and subsequently modifies the applicability of part 801. As in the proposed regulations, the second rule adds part 802 to the CFIUS regulations, which is focused on certain real estate transactions.

The final rules are voluminous and include numerous new terms and provisions, as well as responses to public comments that provide insight into CFIUS’s concerns and intentions. As summarized below, the regulations extend CFIUS’s jurisdiction to a significantly broader class of FDI transactions and will require companies, counsel, advisors, and investors to conduct additional diligence and mitigation planning for transactions in a variety of industries and contexts.

II. PART 800: INCLUSION OF NON-CONTROLLING INVESTMENTS IN TID US BUSINESSES

Before FIRRMA, CFIUS jurisdiction covered only transactions that could result in foreign control of a US business with a nexus to US national security. The first rule (TID Rule) modifies the regulations in part 800 to implement FIRRMA’s extension of CFIUS jurisdiction to cover transactions involving non-controlling investment by a foreign person when:

(1) the target US business is involved in TID activities or industries, and (2) the investment provides the foreign person with access to certain types of information, management rights, or involvement in decision-making.

In other words, under the final regulations, a non-controlling investment may be considered a covered transaction and fall under CFIUS purview if:

(1) The target US business is a TID US business, which is one that:

- produces, designs, tests, manufactures, fabricates, or develops one or more critical technologies;

- owns, operates, manufactures, supplies, or services critical infrastructure; or

- maintains or collects sensitive personal data of U.S. citizens.

and

(2) The foreign person is given any of the following as a result of the investment:

- Access to the target US business’s material nonpublic technical information;

- Membership or observer rights on the target US business’s board of directors or the right to nominate a board member; or

- Any involvement, beyond that through voting shares, in certain substantive decision-making of the target US business involving sensitive personal data, critical technologies, or critical infrastructure.

The TID Rule also implements an interim rule to include a definition of ‘principal place of business.’ The definition, based on the ‘nerve center’ test used by US courts when evaluating federal diversity jurisdiction, is intended to assist parties, particularly investment funds, in determining whether they would be considered foreign entities under the regulations. Treasury will accept public comments on the interim rule until February 18, 2020. However, given the interim rule is effective February 13, 2020, parties must abide by it even during the public comment period.

Also of note, the TID Rule incorporates provisions from the Pilot Program into the regulations at part 800, including the mandatory declaration requirement for covered transactions involving critical technologies that are developed, manufactured, etc., by a US business that is part of specified industries identified by North American Industry Classification System (NAICS) codes.3 However, the regulation exempts from this mandatory declaration requirement certain transactions related to excepted investors, certain mitigated entities, certain encryption technology, and investment funds managed exclusively by, and ultimately controlled by, US nationals.

The finalized regulation also includes a mandatory declaration requirement for investments that result in a foreign government obtaining a ‘substantial interest’ in a TID US business. A ‘substantial interest’ is defined as a voting interest by a foreign person of 25% or more in a US business where a foreign government (other than from an excepted foreign state) has a voting interest of 49% or more in the foreign person investor.

Parties to other covered investments may file a joint voluntary notice (JVN) or submit a short-form declaration to CFIUS in order to potentially qualify for safe harbor from further action by CFIUS regarding the transaction, but such filing is not mandatory.

KEY TERMS AND CONCEPTS:‘Critical technologies’ are defined in the regulation and include items subject to certain levels of US export controls as well as ‘emerging, foundational, or other

critical technologies,’ which are still to be defined by an interagency process led by the US Department of Commerce.

‘Critical infrastructure’ is defined in the regulation and includes subsectors such as telecommunications, utilities, energy, and transportation.

‘Sensitive personal data’ is defined in the regulation and includes ten categories of ‘identifiable’ data (for example: financial, geolocation, and health data) maintained or collected by a US business that: (i) targets or tailors products or services to sensitive populations, including US military members and employees of federal agencies involved in national security, (ii) collects or maintains such data on at least one million individuals, or (iii) has a demonstrated business objective to maintain or collect such data on greater than one million individuals and such data is an integrated part of the US business’s primary products or services. In a change from the proposed regulation, the definition also includes results of an individual’s genetic tests when such results constitute identifiable data.4 Significantly, sensitive personal data limited to that which is identifiable to an individual–data that is fully anonymized, aggregated or encrypted–is not included in the definition.

III. PART 801: PILOT PROGRAM

As noted above, provisions of the Pilot Program have been incorporated into part 800 through the TID Rule, thus ensuring that they persist. Consequently, the TID Rule modifies the applicability of part 801 of the regulations, specifying that this part applies only to Pilot Program-covered transactions for which specified actions occurred between November 10, 2018 (the effective date of the Pilot Program) and February 12, 2020 (prior to the effective date of the TID Rule). Such transactions remain subject to the regulations as set forth in part 801.

3 It is worth noting that Treasury indicated in the preamble to the TID Rule that it anticipates issuing a notice of proposed rulemaking that would base the mandatory declaration requirement on export control licensing requirements rather than on NAICS codes.

4 The proposed rule from September 2019 included the broad term ‘genetic information’ in the definition of ‘sensitive personal data.’ In response to public comments that this was overly broad, the TID Rule narrows the focus to genetic testing data that is identifiable.

INSIGHTS

IV. PART 802: PROVISIONS ON CERTAIN REAL ESTATE TRANSACTIONS

The second rule (Real Estate Rule) establishes new regulations at part 802 of the CFIUS regulations to bring under CFIUS jurisdiction real estate transactions involving foreign person investment in property in/around covered sites. The new regulations follow the approach described in the September 2019 proposed rule and generally focus on certain types of sites and geographic areas around those sites. Specifically, a real estate transaction involving a foreign person would be a covered transaction and fall under CFIUS's purview if the target real property:

- Is itself a ‘covered port,’ or is located within, or functions as part of a ‘covered port’ (certain airports or maritime ports that are identified in specified US Government department lists);

- Is in ‘close proximity’ to or within the ‘extended range’ of certain identified US military installations or sensitive US Government facilities;

- Could reasonably provide the foreign person the ability to collect intelligence on activities being conducted at such an installation, facility, or property; or

- Could otherwise expose national security activities at such an installation, facility, or property to the risk of foreign surveillance.

CFIUS will exercise jurisdiction in these scenarios when there is purchase or lease by, or concession to, a foreign person that affords that foreign person certain property rights. This authority includes review of ‘greenfield’ FDI in previously-undeveloped real property. The process under part 802 is entirely voluntary; there is no mandatory filing requirement in the regulations for covered real estate transactions. However, parties may file a JVN or submit a short-form declaration to CFIUS in order to potentially qualify for safe harbor from further action by CFIUS regarding the transaction.

Transactions involving certain real estate within an ‘urbanized area’ or ‘urban cluster’ are considered ‘excepted real estate transactions,’ which are carved out from CFIUS’s purview.

Further, like the TID Rule, the Real Estate Rule implements an interim rule to include a definition of ‘principal place of business.’ Treasury will accept public comments on the interim rule until February 18, 2020. However, the interim rule is effective February 13, 2020 (meaning parties must abide by it even during the public comment period).

Additionally, Treasury has indicated in the preamble to the Real Estate Rule that it anticipates making a web-based tool available to help the public understand the geographic coverage of the rule. In the interim, Treasury provided information in the rule’s preamble about existing online maps and resources relevant to certain aspects of the rule.

V. EXCEPTED INVESTORS AND INVESTMENT FUND CARVE-OUTS

The finalized FIRRMA regulations cast a broad net over FDI transactions, but also include carve-outs that limit the application of CFIUS’s expanded jurisdiction with respect to certain categories of foreign persons. These ‘exceptions’ to FIRRMA jurisdiction are similar under both the new TID and real estate regulations.

The TID Rule establishes three defined terms in the regulations at part 800 that operate in conjunction to exclude from CFIUS jurisdiction non-controlling FDI in TID US businesses by certain foreign persons:

- Certain foreign persons would be deemed ‘excepted investors’ based on their ties to one or more ‘excepted foreign states’ (see below), and compliance with certain other laws, orders, and regulations. For foreign entities (i.e., not foreign nationals or foreign governments), the definition incorporates additional criteria, including that ‘minimum excepted ownership’ of the foreign entity be held by certain persons, foreign governments, or foreign entities.

- Until February 13, 2022, ‘excepted foreign states’ are foreign states that are included on a list of eligible states published on the Treasury website. As noted in the rule’s preamble, this list currently includes Australia, Canada, and the United Kingdom. Beginning on February 13, 2022 ‘excepted foreign states’ are foreign states that are both (1) included on the list of eligible

INSIGHTS

states, and (2) determined by CFIUS to have a strong established process to assess foreign investments for national security concerns.

- The concept of ‘minimum excepted ownership’ establishes the threshold of ownership interest required based on whether an entity’s equity securities are primarily traded on an exchange in an excepted foreign state or the US.

Similar to the TID Rule, the Real Estate Rule establishes three defined terms in the regulations at part 802 that operate in conjunction to exclude from CFIUS jurisdiction real estate transactions by certain foreign persons.

- Certain foreign persons would be deemed ‘excepted real estate investors,’ analogous to ‘excepted investors’ under the first regulation.

- Until February 13, 2022, ‘excepted real estate foreign states’ are foreign states that are included on a list of eligible states published on the Treasury website. As noted in the rule’s preamble, this list currently includes Australia, Canada, and the United Kingdom. Beginning

on February 13, 2022 ‘excepted real estate foreign states’ are foreign states that are both (1) included on the list of eligible states, and (2) determined by CFIUS to have a strong established process to assess foreign investments for national security concerns.

- The concept of ‘minimum excepted ownership’ is the same as under the TID Rule.

The TID Rule also implements FIRRMA provisions in part 800 that carve out from CFIUS review transactions involving indirect, non-controlling investment in TID US businesses by foreign persons investing as limited partners in investment funds controlled by a US general partner, managing member, or equivalent, provided specified criteria are satisfied. This indirect investment carve-out also applies to indirect investments where foreign governments have a substantial interest.

Note that these carve-outs in part 800 do not apply to control transactions. Transactions that could result in foreign person control of a US business with a nexus to US national security remain subject to CFIUS’s jurisdiction.

INSIGHTS

HOW ANKURA CAN HELP

These long-anticipated regulations present a sea change in the types of FDI that will be subject to CFIUS review. Coupled with CFIUS’s significantly expanded authority and resources to identify non-notified covered transactions and impose monetary penalties for non-compliance, these new regulations represent substantial change in the US FDI environment. The new regulations also will work in tandem with anticipated expanded US export controls for emerging and foundational technologies, and restrictions on using adversary country-sourced gear in US telecommunications networks to significantly elevate national security-related regulatory risks in the US and international business environment.

In order to adapt and succeed in this altered deal environment, US businesses, investors (both US and foreign), advisors, and counsel involved in TID and/or real estate transactions and industries will need to account for these new regulations when designing, conducting diligence, and planning future transactions.

Ankura experts can assist US businesses, organizations, counsel, and advisors to confidently navigate the new CFIUS landscape, and offer the following services:

• Pre-Transaction Risk Assessment

Parties to a potentially CFIUS-covered transaction need to fully understand the review process and the national security threats and vulnerabilities that the US Government will associate with the transaction. Ankura’s professionals include former government intelligence

officials who developed the current CFIUS threat assessment process and reviewed several hundred CFIUS transactions. Our team identifies threat actors and threat vectors that may be considered US national security risks and provides analyses of such threats to clients seeking to best position themselves for CFIUS reviews.

• Transactional Diligence

Ankura’s experts are uniquely positioned to assist transaction parties and counsel to quickly conduct diligence on transaction parties and the target’s business activities to facilitate analysis and decisions regarding CFIUS and FIRRMA regulatory requirements. Ankura has particular technical expertise assisting clients and counsel to determine whether a proposed transaction is subject to FIRRMA TID or real property controls.

• CFIUS Trusts and Investor Assistance

Ankura integrates the financial sophistication and capabilities of a state-chartered trust company to help investors, fund managers, lenders, and counsel implement investment vehicles and transactional processes that facilitate CFIUS-compliant deals. Trusts and Special Purpose Vehicles may be used to credibly operationalize indirect investment carve-outs from CFIUS review where a non-US investor is interested only in the financial benefits of investing in the US economy and companies. Ankura also assists investing entities and parties and their associated US business holdings in designing and implementing operational processes and controls to ensure ongoing compliance with FIRRMA’s passive investment carve-outs. Further, these capabilities are not limited only to use in support of the passive investor carve-outs. They also can be used to facilitate successful CFIUS mitigation in the event of a full CFIUS review and formal mitigation agreement.

• Mitigation Planning and Implementation

Preparation is critical for the execution of successful CFIUS-covered transactions. Transactions need to be designed and mitigation strategies developed to proactively address CFIUS concerns. Ankura works with our clients and their advisors and counsel to develop and implement mitigation proposals and measures that effectively address CFIUS’s national security concerns, including policies, procedures, operational processes, and security controls concerning personnel, assets and materials, data and information, IT and networks, and real property. Ankura has particular expertise addressing the complex interaction of technology, infrastructure, data, and access.

• Third Party Services (Assessments, Audits, and Monitorship)

The increasing operational and technological complexity of methods to mitigate CFIUS national security concerns has prompted CFIUS to occasionally require independent third-party assessments, audits, and/or monitorship of proposed or actual mitigation measures agreed upon during the CFIUS review process. Ankura’s combination of trusted CFIUS experience, enterprise and industry perspective, and technical expertise has enabled our team to become the market leader for effective and credible independent third-party assessments, audits, and monitoring of CFIUS mitigation plans.

ABOUT US Ankura is a business advisory and expert services firm defined by HOW we solve challenges. Whether a client is facing an immediate business challenge, trying to increase the value of their company or protect against future risks, Ankura designs, develops, and executes tailored solutions by assembling the right combination of expertise. We build on this experience with every case, client, and situation, collaborating to create innovative, customized solutions, and strategies designed for today’s ever-changing business environment. This gives our clients unparalleled insight and experience across a wide range of economic, governance, and regulatory challenges. At Ankura, we know that collaboration drives results.

RANDALL H. COOKSenior Managing Directorrandy.cook@ankura.com | +1.646.291.8545 Direct

KAITLYN M. ALESSIDirector kate.alessi@ankura.com | +1.443.201.6314 Mobile

CONTACT US

© 2020 Ankura Consulting Group, LLC

INSIGHTS