CFIUS Issues Final FIRRMA Regulations

Final regulations implementing nearly all elements of the Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA) were released on January 13, 2020, by the U.S. Department of the Treasury, as chair of the Committee on Foreign Investment in the United States (CFIUS). Official versions of the final regulations are expected to be published in the Federal Register on January 17, 2020. The new regulations, which take effect on February 13, 2020, resolve 18 months of speculation and uncertainty since FIRRMA was enacted in August 2018 as a piece of landmark CFIUS reform legislation. 

As previewed in the draft FIRRMA regulations published on September 17, 2019, the final regulations expand CFIUS’s jurisdictional reach over certain noncontrolling investments and a broader range of real estate transactions. The final regulations also delineate the criteria for mandatory CFIUS filings for transactions involving businesses engaged in critical Technology, critical Infrastructure, or sensitive personal Data of U.S. citizens (collectively referred to by CFIUS as “TID”) and extend, with some revisions, the former “pilot program” requiring mandatory CFIUS filings for certain critical technology transactions.

This note provides an overview of key elements of the new regulations. Future notes, to be published in the coming days, will provide more detailed information on the regulations provisions governing real estate transactions, U.S.-managed investment funds, mandatory CFIUS filings, and investors from excepted countries. 

How the Final FIRRMA Regulations Address Key Issues in the Draft Rules

In our client alert on September 19, 2019, we flagged a number of key issues that were partially addressed in the draft FIRRMA regulations, many of which became the subject of public comments. The final FIRRMA regulations settle many of these issues as follows:

Definition of “U.S. business.”

The final FIRRMA rules continue to exclude the proviso from the 2008 CFIUS regulations that a U.S. business is any entity that is engaged in interstate commerce in the United States, but “only to the extent of its activities in interstate commerce.” Deletion of this proviso from FIRRMA and the draft regulations raised concerns about expanded extraterritorial assertion of CFIUS jurisdiction. The expanded examples included with the final regulations provide some assurance that this is not CFIUS’s intent.  As clarified in the final regulations, exports, technology licenses, and technical support by non-U.S. companies to U.S. customers do not constitute a “U.S. business” for CFIUS purposes unless such activities are carried out through branches, subsidiaries, personnel, or other assets in the United States.

Definition of “control.”

CFIUS received a number of comments seeking greater clarity, and in some cases higher thresholds, for the definition of control, a critical element of CFIUS’s jurisdictional analysis. CFIUS determined that substantive changes to its current, “well-established” control standard would not increase certainty for parties.

“Safe harbor” for foreign investments via U.S.-managed funds

Recognizing the importance of private equity and venture capital funds to U.S. investment activity, and also acknowledging that fund participants may include non-U.S. investors with little to no involvement in the funds’ portfolio businesses, FIRRMA authorized CFIUS to exempt certain indirect foreign investments via U.S.-managed funds from (i) CFIUS jurisdiction over non-controlling investments in TID businesses, (ii) mandatory CFIUS filings for foreign government-backed investments in TID businesses, and (iii) mandatory filings for investments in critical technology businesses under the successor to CFIUS’s expiring “pilot program.” 

The mechanisms of this safe harbor differ somewhat for each of these scenarios, but fundamentally rely on a general partner or managing member of the investment fund not being a “foreign person,” defined as a foreign national, foreign government, or foreign entity, or any entity over which control is exercised by a foreign national, foreign government, or foreign entity. In turn, CFIUS defines “foreign entity” as any entity organized under non-U.S. law if either the principal place of business or the exchange where its shares are primarily traded is outside the United States. 

In response to public comments noting that U.S. investment funds may have general partners legally domiciled offshore even though key management decisions are taken in the United States, the final FIRRMA regulations include an interim definition of “principal place of business” that looks to where fund activities and investments are primarily directed by or on behalf of the general partner. This definition, if finalized after a 30-day public comment period, may allow more U.S.-managed funds to rely on the safe harbor, with one important proviso: If the general partner has stated in its most recent submission to any U.S., state, or foreign government that the general partner’s principal place of business is outside the United States, that location will be treated by CFIUS as definitive unless the general partner can demonstrate that its principal place of business has subsequently changed to a United States location.

In the coming days, we will issue a separate client alert addressing CFIUS’s provisions for U.S.-managed funds in greater detail.

Definition of “substantial interest”

The draft regulations mandate CFIUS filings for certain investments in TID businesses where a non-U.S. investor has a “substantial interest” defined by two distinct thresholds: the non-U.S. investor would acquire a 25 percent interest in a TID business, and a foreign government would hold a 49 percent interest in the non-U.S. investor. The final regulations clarify that the foreign government ownership threshold must be met by the national and/or subnational governments of a single country; multiple countries’ interests are not aggregated.

The draft regulations also provided that if the non-U.S. investor was a limited partnership, the 49 percent threshold could be met by ownership of either the general partner or the limited partnership interests. The final FIRRMA regulations eliminate the trigger based on ownership of limited partnership interests; as implemented, only foreign government ownership of the general partner will be relevant in this context.

Nexus between personal data and national security.

TID businesses are subject to the expansion of CFIUS's jurisdiction over noncontrolling foreign investments and mandatory CFIUS filings for certain non-U.S. investors. Recognizing the broad use and availability of personal data to U.S. businesses, the final FIRRMA regulations largely repeat the provisions of the draft regulations, but with some important distinctions further limiting their scope. Personal data deemed “sensitive” by CFIUS now includes personally identifiable data collected or maintained by a U.S. business that:

  • targets U.S. government agencies and contractors with intelligence, national security or homeland security responsibilities;
  • has collected or maintained identifiable data on at least one million individuals (not necessarily U.S. citizens) during the preceding year; or
  • has the demonstrated business objective, as part of its primary products or services, to collect data on at least one million individuals


  • The personally identifiable data fall within one of the following categories:
    • data on individuals’ financial distress or hardship;
    • credit report data not obtained for purposes permitted under the Fair Credit Reporting Act;
    • information submitted as part of insurance applications;
    • health data concerning individuals;
    • nonpublic electronic communications collected to facilitate third party communications (e.g., messaging applications);
    • geolocation data;
    • biometric enrollment data;
    • data used to obtain government identification cards;
    • data concerning the status of personnel security clearances; or
    • genetic test results, excluding information derived from U.S. government databases that is routinely provided to private parties for research purposes.

Preferential treatment of investors from certain countries

FIRRMA authorized CFIUS to designate certain countries as “excepted foreign states” (or for certain real estate transactions, “excepted real estate foreign states”) and certain parties from those countries as “excepted investors” or “excepted real estate investors” who are not subject to expanded CFIUS jurisdiction or mandatory CFIUS filings.

  • Although public comments on the draft regulations include requests for excepted status from several countries, CFIUS has initially determined that only Australia, Canada, and the United Kingdom are eligible, though it expects to add other countries over time. To retain this designation after February 2022, CFIUS must also reach a determination that the countries have a “robust” process for (i) assessing national security risks arising from foreign investments and (ii) coordinating with the U.S. government on national security issues.
  • To qualify as an excepted investor or excepted real estate investor, the foreign party must be the government of an excepted country, a national of an excepted country and/or the United States (not counting individuals who hold dual nationality in another country that is not an excepted country), or any entity organized and headquartered in the United States or an excepted country for which (i) at least 75 percent of the voting members and observers on the board of directors, counted separately, are from excepted countries and/or the United States and (ii) anyone holding at least 10 percent of the entity is also from excepted countries and/or the United States. If a 10 percent owner is itself an entity, the regulations impose additional indirect ownership requirements. The final FIRRMA regulations loosened the board membership and significant ownership qualifications for entities where previously under the draft regulations, the entire board of directors and all owners of 5 percent or more of the entity had to come from excepted countries and/or the United States.
Open Issues

Calling the newly published FIRRMA regulations “final” is something of a misnomer, as a number of items relating to FIRRMA remain unresolved:

CFIUS filing fees

FIRRMA authorized CFIUS to begin collecting filing fees in connection with full-length CFIUS notices, based on a transaction-specific formula expected  to be defined in regulations. CFIUS has not yet issued those regulations, but a draft rulemaking is forthcoming. Once the regulations take effect, maximum filing fees will be up to the lesser of 1 percent of the value of the transaction or US$300k (subject to annual adjustment for inflation).

Final definition of “principal place of business.”

As discussed above, CFIUS has issued an interim definition of “principal place of business” that may allow U.S.-managed entities, even if they are domiciled abroad, not to be treated as “foreign persons” under the FIRRMA regulations. This, in turn, can narrow the scope of CFIUS’s jurisdiction and broaden the safe harbor for indirect foreign investments via U.S.-managed investment funds. The interim definition will be used starting February 13, 2020, though the deadline for public comments on the interim definition will be a few days later and could result in further changes to the definition. 

Standards for identifying “excepted” countries.

As discussed above, for “excepted” countries to maintain their designations after February 2022, or for CFIUS to designate additional countries as “excepted” after that date, CFIUS must be able to determine whether each country has a “robust” (i) national security-based foreign investment review process and (ii) process for bilateral cooperation on such reviews. The final FIRRMA rules acknowledge that CFIUS will require additional time—up to the next two years—to develop processes and procedures to make those determinations.

As noted throughout the FIRRMA regulations, CFIUS expects to issue future updates to the rules in the future as necessary to reflect changes in the broader national security landscape as well as specific factors such as technology, data use, and business practices.

* * *

We will issue a series of client alerts addressing various elements of the FIRRMA regulations in greater detail. We note, however, that the FIRRMA regulations include many nuances and exceptions; complying with the regulations will continue to require a thorough analysis of the specific facts and circumstances before they can be applied to individual transactions involving U.S. businesses and real estate. We strongly advise prospective parties to consult with experienced counsel before undertaking these transactions.