This article originally was published by Law360 on June 27, 2018.

Many people know that the Committee on Foreign Investment in the United States (CFIUS) has broad jurisdiction to review for national security concerns any significant acquisitions of a U.S. business by “foreign persons.” Some people also know that CFIUS’ jurisdiction includes investments in U.S. businesses by foreign persons, if the investments are more than trivial (under 10 percent voting power) and are not purely passive.

It is less well-known that by accepting foreign investments, an American company can itself become a “foreign person” for purposes of CFIUS. That means that future investments or acquisitions by the American company of U.S. businesses will be subject to CFIUS review, just as if the American company were a Chinese, German or Canadian firm.

The “Inadvertent Foreign Person” Trap

American companies today are part of the global economy, and not just in terms of their commercial activities. American companies accept investments from foreign (non-U.S.) investors, enter into partnerships and joint ventures with foreign firms, and are sometimes acquired by foreign buyers. American companies also frequently make investments in other American companies or grow by acquisition of other American companies.

When a foreign person makes an investment in an American business, the parties have to consider whether to make a voluntary filing with CFIUS. Not all transactions are covered by CFIUS. Essentially, the transaction must be an investment or acquisition, by a “foreign person,” giving the foreign person some ability to influence key decisions affecting the U.S. business, and it must implicate national security. Some types of transactions are not covered, such as purely passive investments, debt that does not have indicia of control, and a few other specialized categories.

If a transaction is a “covered transaction,” CFIUS has jurisdiction and the parties must decide whether to make a voluntary filing with the committee. If they choose not to make a voluntary filing, CFIUS retains jurisdiction indefinitely. If CFIUS reviews a transaction — before or after the transaction has closed — and cannot resolve any “national security concerns,” it can request mitigation steps and even divestiture by the foreign investor. If the parties don’t comply, CFIUS can refer the case to the White House, which can order compliance.

Over the years, many American companies have accepted investments from foreign venture capital or private equity funds, strategic partners, or even non-U.S. individuals without making a voluntary CFIUS filing. In the past, foreign investment in U.S. businesses was only rarely a matter of great concern. Today, however, foreign investments in U.S. businesses — that is, any transaction where a foreign person gains some degree of influence over a U.S. business or access to technical proprietary information — are under the microscope. This is especially true for investments from China, where the CFIUS clearance rate has fallen by 20-30 percent under the Trump administration.

The “inadvertent foreign person” trap is this: An American company that has taken enough investment from non-U.S. sources such that more than 10 percent of its voting equity is now held by foreign persons technically may have become a foreign person itself. This is because, whether the investor is incorporated in the United States or not, any investment in or acquisition of a U.S. business must be tested to see if the investor or buyer is a “foreign person” — and the test is the same in either case.

An investor or buyer is a “foreign person” for CFIUS purposes if it is an entity over which some degree of control (how much control is not well-defined) can be exercised by a “foreign national,” “foreign government” or “foreign entity. Thus, although an entity organized in the U.S. is clearly not a “foreign entity,” it nevertheless could be a “foreign person” if there is a sufficient degree of control exercised over that entity by a foreign individual, entity or government.

How much “control” is too much? Congress left the definition to the committee, and the committee has taken a “functional” approach that “eschews bright lines.” Essentially, “control” means the ability to direct or decide “important matters” affecting an entity, as shown by ownership of voting interests, board representation, proxy voting, special shares, contractual arrangements, formal or informal arrangements to act in concert or other means.

To pull these threads together, let’s assume two entrepreneurs start a company in Silicon Valley making a wearable fitness device. If both of them are U.S. passport holders and U.S. residents, clearly the company is not a “foreign person”; this would be true even if the company were formed in the Cayman Islands, for example. But if one of them is a foreign national or resident, it is quite possible the startup will be a “foreign person” for CFIUS purposes right from the outset. Parenthetically, if it is operating in the United States, it is also a “U.S. business,” so an investment into the startup by another foreign person would be subject to CFIUS review.

The new company succeeds in attracting funding from an investor in Menlo Park, California. The investor gets typical “Series A” voting rights, 15 percent of the company, and a board seat. If the investor is not a foreign person, then CFIUS does not cover this investment.

The company does well and its next round of funding is from a Chinese technology investment fund or strategic investor. The Series B terms give the new investors essentially the same rights as the Series A: certain voting rights, 15 percent of the company, and a board seat. That investment is clearly by a foreign person, in a U.S. business, and probably confers enough “control” to be captured by CFIUS. The parties decide not to make a voluntary CFIUS filing, however, because it can be expensive, cause a delay in funding, and they don’t believe their technology, operations or location raise any national security concerns.

Three years later, the company has raised another round or two, including from other foreign investors, never making a CFIUS filing. Now the company wants to grow by making a significant strategic investment in, or perhaps even acquiring, an artificial intelligence company that will enhance its product offering, or a social media company that will allow its customers to share information about their workouts, biking routes and other personal information.

What this thoroughly American company may not realize is that, over time, and inadvertently, even though it is still a Delaware corporation with all its operations in California, it has become a foreign person for purposes of CFIUS because one or more “foreign persons” (its investors) have enough “control” that the CFIUS test is met when applied to the American company.

If that test is met, then our American company’s own investments or acquisitions are subject to scrutiny by CFIUS. Given the nature of the target company in this example, national security concerns might well be present, and CFIUS could require complicated mitigation steps and in the worst case, bar the transaction. Moreover, if the target is aware of this problem, it could put our company at a competitive disadvantage, compared to bidders who are not “foreign persons,” in competing for the deal. If the company goes ahead with the transaction without making the voluntary filing, it and its investment will forever be subject to the possibility that CFIUS will notice the deal and require a filing.

If the American company is feeling like Damocles, sitting at a banquet with a sword hanging over him by a single thread, it would not be far wrong. This may be an unintended consequence of the current hostility toward investment from certain countries, but that does not make it less real. In fact, Congress is now considering expanding the scope of CFIUS reviews, making even more types of transactions potentially covered.

The situation may change in the future, but for now, American companies that are inevitably players in a global financial, technological and commercial marketplace have one more thing to worry about.