The US Foreign Investment Risk Review Modernization Act, 2018 (FIRRMA) became effective on August 13, 2018 with further new proposed rules published on September 24, 2019 (the “Proposed Rules”). The Proposed Rules are not yet effective, pending comments from the public, but by law the rules must be finalized before February 13, 2020.

CFIUS, composed of representatives from 16 US departments and agencies, is an interagency committee authorized to review certain transactions involving foreign investment and national security into the United States. The statutory authority for CFIUS dates from the 1980s and the current CFIUS regulations were published in 2008.

FIRRMA significantly expanded the scope of the Committee’s jurisdiction. A 2018 “pilot program” pursuant to FIRRMA made filings—previously all voluntary—mandatory in critical sectors, even where the foreign investor did not obtain “control” over the US business.

The Proposed Rules expand CFIUS’s jurisdiction even further, requiring filings for non-controlling investments in a broader range of industries, and a mandatory filing if a foreign government would hold directly or indirectly a “substantial interest”. The Proposed Rules would also add a separate rule regarding real estate transactions.

FIRRMA May Apply to India Related Venture Capital Funds and Portfolio Companies

CFIUS applies generally to any transaction “with a foreign person which could result in foreign control of any person engaged in interstate commerce in the United States.” [1] This is a broad grant of jurisdiction and the definitions are critical.

Control Investments

A venture capital investor or a portfolio company is a “foreign person”[2] for CFIUS purposes if it is an entity over which some degree of control (broadly defined) can be exercised by a “foreign national”[3] , “foreign government”[4] or “foreign entity. [5] “Control” means the ability to direct or decide “important matters” affecting an entity, as evidenced by ownership of voting interests (generally 10% or more by vote will be considered “control”), board representation, proxy voting, special shares, contractual arrangements, and formal or informal arrangements to act in concert or other means. Transactions involving the types of “control” mentioned above are known as “covered transactions” under the current regulations and “covered control transactions” under the Proposed Rules.

Non-controlling Investments

A 2018 pilot program initiated pursuant to FIRRMA reflected the legislation’s grant of authority to cover not only “control” investment but certain “non-controlling” investments. The pilot program made certain non-controlling investments [6]subject to a mandatory filing regime if they involve critical technology and the investor is afforded certain types of non-controlling rights. Such non-controlling rights include access to material non-public technical information, board or observer rights, or involvement in significant decisions regarding the critical technology.

Expansion to More Industries

The Proposed Rule preserves the pilot program for now but establishes a new category of non-controlling investments, called “covered investments,” in a broad range of industries. FIRRMA “covered investments” will be investments in a business involved in critical technologies, critical infrastructure or sensitive personal data (a “TID US business” - TID is an acronym for Technology, Infrastructure and Data[7] ), if such transactions allow the foreign person access to material non-public technical information of the TID US business. Additional criteria include board membership or observer rights or any involvement in substantive decision-making regarding certain actions related to the TID US business.

A “Flip” to a Delaware Holding Company May Be Captured by FIRMMA

Many Indian companies “flip” their corporate structure to the US, particularly using Delaware as a jurisdiction of incorporation. There are a number of unintended consequences that may result from such a flip.

Is the Flip Itself Covered by CFIUS?

First, before executing the flip, the parties should consider whether the flip itself could be regarded as a covered transaction. Assuming the Indian company already has foreign persons among its significant shareholders, the flip is certainly a transaction which would result in control of a US entity by foreign persons—although in this case they would be the same foreign persons. The original guidance to the original CFIUS regulations suggests that a pure corporate reorganization, where the control of the entities does not change, “generally would not present national security considerations.” The question is highly fact-dependent,[8] however, and the parties should consult legal counsel.

Does the Flip Make Future Financings Subject to CFIUS Review?

Second, if prior to the flip the Indian company was not involved in US interstate commerce, it was not a “US business” for purposes of CFIUS. Investments into the company therefore were outside the jurisdiction of CFIUS.

However, if the flip results in the company commencing to “engage in interstate commerce in the US,” then any future controlling and certain non-controlling investments into the company by foreign persons almost certainly would be covered by CFIUS.” An argument might be made that the flipped company is not engaged in US interstate commerce if it is purely a holding company, but the question is highly fact-dependent, and the Proposed Rule appears to expand, rather than reduce, the scope of this term under CFIUS[9].

As noted above, where a transaction is a covered transaction, the filing with CFIUS is voluntary except in certain situations involving critical technologies, where the filing is mandatory even for many non-controlling investments. In addition, the Proposed Rules will expand the scope of covered non-controlling transactions to cover any business which falls within the definition of a “TID US business.”

Is the “Flipped” Company Itself a “Foreign Person”?

Finally, the newly “flipped” Delaware company itself may become a foreign person for purposes of CFIUS if one or more foreign persons (i.e. Indian citizens or entities) have sufficient control of the company.

It is important to note that the determinative factor is the element of control by foreign persons, which means that a company may not be a foreign person if it is controlled by US citizens, even if it is incorporated in Mauritius, Cayman Islands, Singapore or any other non-US jurisdiction, whereas a US company may be a foreign person if it is controlled by foreign persons (including Indian citizens). Note that foreign entities include Mauritius, Cayman Islands and Singapore incorporated venture capital funds (popular jurisdictions for India related venture capital funds) which have foreign persons as general partners—as well as venture capital funds that look like US entities but have foreign persons in their control group.

Depending on the facts of a given case, therefore, the Delaware company’s own investments or acquisitions may be subject to the CFIUS voluntary filing regime, and to the mandatory filing regime depending on the nature of the target company. Once again, the details are critical and legal counsel should be consulted.

Critical Industries Attracting US Foreign Investment Review:

As noted above, the voluntary CFIUS filing regime applies to any transaction which could result in a foreign person acquiring the minimal requisite level of control over a US business. This regime applies whether the target business is in a critical sector or not.

Under the pilot program, however, a filing is mandatory for all controlling, and some non-controlling, investments in critical companies, known as “pilot program US businesses.”

“Pilot program US business” is defined as a US business that (a) produces, designs, tests, manufactures, fabricates or develops a “critical technology” that is (b) utilized in connection with the US business’s activities in one or more “pilot program industries,” or (c) that is designed by the US business specifically for use in one or more “pilot program industries.” [10]

“Critical technology” is defined as defense articles and items on the US Munitions List, many of the categories of items subject to US export control, certain nuclear facilities and equipment, select agents and toxins, and “emerging and foundational technologies.” [11]

“Emerging and foundational technologies” is a term not defined in the pilot program regulations. However, in 2018 the Commerce Department's Bureau of Industry and Security (BIS) released an advance notice of proposed rulemaking listing 14 categories of technologies under consideration as “emerging and foundational,” including all artificial intelligence, data analytics, additive manufacturing (e.g., 3D printing) and robotics.[12]

The list is not currently effective and it is not known when the final list will be promulgated, but the expansive reach of the proposed list has caused concern among international technology companies.

“Pilot program industries” is defined by reference to North American Industry Classification System (“NAICS”) codes, and covers 27 industries, including some key areas which affect venture capital investment, including : [13]

  •  defense and defense-related industries
  •  computer storage device manufacturing
  •  electronic component manufacturing
  •  optical instrument and lens manufacturing
  •  power, distribution, and specialty transformer manufacturing
  •  primary battery manufacturing (possibly including electric battery manufacturing)
  •  radio, television broadcasting, and wireless communications equipment manufacturing (possibly including mobile phones)
  •  research and development in nanotechnology
  •  research and development in biotechnology
  •  semiconductor and related device manufacturing; and
  •  telephone apparatus manufacturing (possibly including mobile phones)

It is important to note that transactions having potential national security risks, even if not involving industries listed above, may also be captured by CFIUS. The Proposed Rules add new criteria regarding “sensitive personal data”. Such sensitive personal data must be (1) identifiable; or (2) related to US government personnel or contractors; or (3) involving more than one million individuals and the TID US business has a demonstrated business objective to collect such data as an integral part of the business’ primary products or services. [14]

The Proposed Rules also add separate and concurrent regulations for real estate. Covered real estate transaction would include two main categories: (1) real estate “described by its relation to airports and maritime ports”, and (2) real estate “described by its relation to US military installations and other properties of the US government that are sensitive for national security reasons”. [15]

Voluntary vs. Mandatory Filings

The CFIUS filing regime is a voluntary process by which parties who engage in economic or financial activities that are or may be considered as “covered transactions” (i.e. directly or indirectly controlled transaction involving foreign persons in critical industries) request the Committee for approval and/or clearance with conditions. Although filing may technically be voluntary, it is critical to note that CFIUS retains the right to review, require changes or direct the unwinding of a transaction after closing if no filing is made.

The 2018 pilot program made all controlling, and some non-controlling investments into “pilot program US businesses” subject to a mandatory declaration filing regime. The Proposed Rules leave the pilot program in place, but are expected to assess the scope of the program in the final rules.

The Proposed Rules would retain the basic voluntary filing system, but make two important changes. First, parties would have the option to file an abbreviated “declaration” instead of a full filing if they believe a transaction is not particularly sensitive. Second, filings will become mandatory for any covered transaction that results in a foreign government having a “substantial interest” in a TID US business.

The Proposed Rules would exempt certain investors from certain foreign countries in the case of non-controlling investments in a TID US business. The list of “excepted foreign countries” is the so-called “white list” that has been mentioned in the press. The “excepted foreign states” may from time to time be identified by the Chairperson of CFIUS, with the approval of a majority of its voting members. Thus far, CFIUS has not designated any “excepted foreign state”. [16]

Sovereign Wealth Related Venture Capital Funds Face Additional Foreign Investment Scrutiny

A sovereign wealth fund (SWF) is a state-owned investment fund or entity. [17] According to a recent report, SWFs made 147 direct investments amounting to $23.4 billion in unlisted private companies around the world in 2018.

The Proposed Rules would require mandatory declarations for transactions resulting in the acquisition of a “substantial interest” in a US business by an investor in which a foreign government holds a “substantial interest”. “Substantial interest” has not been defined by CFIUS yet. However, it is possible that it will follow the definition of “control” mentioned above.

Venture Capital Funds Need to Be Structured to Minimize CFIUS Risk

The pilot program regulations under FIRRMA provide an exemption from the CFIUS filing for foreign investments made through certain types of investment funds. The Proposed Rules would expand such exemption in the pilot program to any investment in a TID US business. The exemption applies when a foreign investor has membership as a limited partner or equivalent on an advisory board or a committee of the fund and when all of the following criteria are met: [18]

  •  The fund is managed exclusively by a general partner who is not a foreign person (i.e. GP must be a US citizen);
  •  Neither the advisory board nor the foreign person has the ability to approve, disapprove, or otherwise control investment decisions of the fund or the entities in which the fund is invested or to unilaterally select or dismiss the general partner;
  •  The foreign person does not have access to material non-public technical information as a result of its participation on the advisory board or committee; and
  •  The fund is an ‘‘investment company,’’ as defined in section 3(a) of the Investment Company Act of 1940 ;[19]

Many Mauritius, Cayman Islands and Singapore incorporated venture capital funds may not be able to meet the criteria mentioned above, and these US investments may therefore be subject to CFIUS review.

Addressing CFIUS Risk in Venture Capital Transactions:

(a) Due Diligence

CFIUS risk must be regarded as an important item in transaction due diligence of target portfolio companies. Before a proposed investment is made, it must be determined whether a filing is mandatory because the investment is in a critical industry and foreign investors may have control. Evaluation of whether the proposed target portfolio business is involved in a critical industry and whether it is controlled by foreign persons should be conducted in the pre-investment due diligence process.

(b) Disclosure in Venture Capital Funds Private Placement Memorandums (PPM)

The risk factors section forms an extensive part of a venture capital fund’s PPM, as the venture capital fund must disclose possible risks related to its investment strategy. A venture capital fund must evaluate whether its strategy and proposed portfolio investments are captured by FIRRMA and disclose the related risk of CIFIUS review in the PPM.

(c) Limited Partnership Agreement (LPA) and Share Purchase Agreements (SPA) Provisions

Venture capital funds and portfolio companies may need to provide representations and warranties in LPAs and SPAs that they are not foreign persons or otherwise subject to CFIUS review. They may also need to provide corresponding indemnities for any breach of such representations and warranties.

“Real World” Risks in US-India Cross Border Transactions

In April 2011, a Chennai-based financial services technology company acquired an 85.3 percent stake of a California-based company which provides digital identification authentication services including to US government agencies. No notice was filed with CFIUS. This resulted in CFIUS conducting a post-closing review of the transaction and directing the Indian company to divest its stake in the US target company. [20] This “real world” case serves as an example of the potential risks which must be considered in US-India cross border transactions.