On August 13, 2018, the Foreign Investment Risk Review Modernization Act of 2018 (or FIRRMA for short) was signed into law, ushering in an unprecedented expansion in the jurisdiction of the Committee on Foreign Investment in the United States (or more commonly known as CFIUS). As our colleagues, Chuck Comey and Jim Ryan, mentioned in an earlier article, the enactment of FIRRMA capped months of escalation in the U.S./China trade relations. The expanded jurisdiction of CFIUS may result in financing transactions becoming subject to mandatory CFIUS declaration requirements prior to closing. Investors and companies alike should therefore take CFIUS considerations into account at the outset of any fundraising effort, even if the investment is not a controlling investment and the transaction is not expected to otherwise have any direct national security implications.

New development: CFIUS's jurisdiction has expanded to cover non-controlling investments in certain industries

1. Non-Controlling Investments in "Critical Technologies"

Prior to the enactment of FIRRMA, CFIUS only had jurisdiction to review transactions that could result (directly or indirectly) in "control" (broadly defined to include as little as 10% voting interest) in U.S. companies or U.S. assets by a foreign-owned or controlled person. The CFIUS review regime was also voluntary; there was no requirement to notify CFIUS of a transaction prior to closing, even if that transaction fell within CFIUS's jurisdiction.
With the enactment of FIRRMA, CFIUS's jurisdiction was expanded to include, among other things, certain non-controlling investments in U.S. businesses involving critical infrastructure, critical technologies, or sensitive data pertaining to U.S. persons. This expanded jurisdiction is expected to be fully effective by February 2020 when CFIUS issues regulations implementing various FIRRMA provisions.
In the meantime, CFIUS has implemented the first stage of this jurisdictional expansion through the critical technologies "pilot program," which applies to investments in U.S. businesses that produce, design, test, manufacture, fabricate or develop "critical technologies" (we will refer to such a business as an "Applicable U.S. Business"). Currently, critical technologies consist only of certain items controlled under the International Traffic in Arms Regulations or the Export Administration Regulations, nuclear materials and equipment, and select agents and toxins. However, the Commerce Department is currently preparing new export control regulations that will identify "emerging and foundational technologies," which will also be considered critical technologies for CFIUS purposes. These emerging and foundational technologies are expected to include cutting-edge technology such as artificial intelligence, 3D printing, robotics, and genetic engineering, among others.
Importantly, CFIUS's expanded review jurisdiction applies not only to such investments made directly by foreign persons, but also investments made by funds that have foreign persons as limited partners on an advisory board or committee of the fund. FIRRMA includes a limited carve-out that excludes from its jurisdiction funds that have one or more foreign limited partners, but where (i) the fund is managed by a general partner or managing member that is not a foreign person, (ii) the advisory board or committee on which the foreign limited partner sits does not control investment decisions of the fund or the general partner, (iii) the foreign limited partner does not control the fund, and (iv) the foreign limited partner does not have access to material nonpublic technical information of the portfolio companies of the fund.

2. Pilot Program Industries

A non-controlling investment by a foreign person in an Applicable U.S. Business is not, by itself, enough to trigger the mandatory CFIUS notification requirements. The critical technology produced by the Applicable U.S. Business must be one that is used in connection with the activities of the Applicable U.S. Business in one or more of the 27 specified industries (called "pilot program industries"), or that is specifically designed by the Applicable U.S. Business for use in one or more pilot program industries. The list of pilot program industries currently includes fields such as "Research and Development in Nanotechnology," "Research and Development in Biotechnology," "Semiconductor and Related Device Manufacturing," and, of course, various dual-use industries.

3. Access or Influence by the Foreign Investor

The third prong of the critical technologies pilot program jurisdiction involves the extent to which the investment will provide the foreign person access to information regarding critical technologies or influence over the activities of the Applicable U.S. Business. In addition to controlling investments, non-controlling investments that meet the first two requirements above are subject to the pilot program if they would afford a foreign person (a) access to material nonpublic technical information (financial information is expressly excluded from this definition); (b) membership or observer rights on the board of directors of the Applicable U.S. Business or the right to nominate an individual or observer to the board of directors; or (c) any involvement in substantive decision making of the Applicable U.S. Business regarding the use, development, acquisition, or release of critical technology.

4. Declaration or Notice Requirement and Review Period

The parties to an investment subject to the critical technologies pilot program must submit either an abbreviated declaration or a full notice to CFIUS at least 45 days prior to closing. If the parties choose to submit a declaration, CFIUS has 30 days to review it, at the end of which CFIUS can provide one of four responses: (i) request a full written notice; (ii) inform the parties that it cannot make a determination based on the declaration alone, and that they may file a full notice; (iii) initiate a unilateral investigation of the transaction; or (iv) "clear" the transaction by informing the parties that CFIUS has concluded all action. Failure to provide the required declaration or notice could result in fines up to the total value of the investment.
If CFIUS has national security concerns with respect to a particular investment, it would seek to impose mitigation to address such concerns. Mitigation may include, among other measures, limitations on the foreign investor having access to certain target company technology and facilities. In rare cases where CFIUS determines that national security concerns associated with the transaction cannot be mitigated, CFIUS can also recommend that the President issue an executive order blocking the transaction, or for closed transactions, requiring the foreign person to divest its interest in the U.S. business (which might lead to a "fire sale").

What does this development mean for investors and companies looking to raise funds?

Given the potentially significant penalties if a required filing is not made, investors and companies raising funds must carefully consider the relevant facts and the above legal developments (some of which are still in progress) at the outset of a financing transaction and, together with their legal advisors, develop a plan for navigating these issues.

1. Know Where You Stand; Be Prepared

For U.S. companies looking to raise money, it would be prudent to do a preliminary CFIUS risk assessment to determine, among other things, whether the technology produced by the company would be considered "critical technology" and whether it implicates one or more pilot program industries. Discussing any concerns with counsel as early as possible in the financing process will help identify risks of which management should be mindful in approaching and negotiating with investors.

2. Consider the Implications With Respect to Potential Investors

For a U.S. company that produces critical technology used in a pilot program industry, having foreign investors is not out of the question, and there may be any number of strategic reasons why having such investors may in fact provide a net benefit to the company. However, management should accept investments from foreign investors only after having considered whether additional regulatory compliance is needed. This includes determining whether the investor is a foreign person or, if an investment fund, has a foreign limited partner that may make the transaction subject to CFIUS's jurisdiction. Some investment funds prefer not to disclose their limited partners to their portfolio companies. However, management may still ask potential investment fund investors about their investment and decision-making process to properly understand whether there is any regulatory risk. It may also be prudent for U.S. companies to include representations and warranties by investors in the financing documents to address these CFIUS risks.

3. Consider the Rights Being Provided to Investors

Some of the investor rights that would trigger a CFIUS notification requirement are rights that are commonly provided to lead investors in a financing. For example, it is common for the lead investor (and in some cases other large investors) to receive board representation and/or observer rights. Therefore, where a U.S. company that produces critical technology used in a pilot program industry proposes to take an investment from a foreign person, management must carefully consider whether certain rights should be denied to such an investor or, alternatively, whether the company will implement proper compliance procedures, including filing of a CFIUS declaration or notice.

4. Be Careful About Existing Investors, Too

Finally, the new CFIUS regulations discussed above could apply to a new investment by an existing investor as well, and not only to investments by new investors. For example, if an existing foreign investor participates in a new financing round of an Applicable U.S. Business and obtains additional control, governance, or information rights, this could trigger a mandatory CFIUS declaration requirement. As such, management must take into account the identity of existing investors in new rounds, and may need to curtail the rights of certain investors or be prepared to comply with the new CFIUS notification requirements. In connection with a review of a notified transaction for a new investor, CFIUS can also inquire about prior financings that resulted in existing investors acquiring control of the U.S. business, and request that the parties submit a CFIUS notice for such prior transactions.

Prudent risk management leads to better results

The legal developments mentioned above, as well as subsequent developments that will surely follow, yet again bring into focus the importance of proper risk management. Management and investors know very well that risk is an inherent part of any business. The key question is how will risk be managed to put the company on the best course towards success? The discussion above will hopefully help management and investors chart the right course.

Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Morrison & Foerster LLP. All rights reserved