On September 17, 2019, the Committee on Foreign Investment in the United States (CFIUS) issued two long-awaited notices of proposed rulemaking (NPRMs) to implement the overhaul of its governing statute (section 721 of the Defense Production Act of 1950, which is codified at 50 U.S.C. 4565), adopted on August 13, 2018, known as the Foreign Investment Risk Review Modernization Act (FIRRMA).1 As we explained in previous International Trade Alerts (available here and here), FIRRMA made important changes to the way CFIUS conducts national security reviews of mergers and acquisitions and other transactions involving non-U.S. investors. It expanded CFIUS's jurisdiction in two important respects. Whereas previously CFIUS had been limited to reviewing transactions in which a foreign person could acquire control of a U.S. business, FIRRMA gives it the authority to review certain substantial albeit non-controlling investments in businesses dealing with critical technologies, critical infrastructure, and sensitive personal data of U.S. citizens.2 FIRRMA also gives CFIUS the authority to review certain real estate investments (even in the absence of an existing business associated with such real estate) based on proximity to airports, maritime ports, military installations and other sensitive U.S. government properties.3

FIRRMA also makes a number of other very important innovations, including: establishment of the option for transaction parties to file an abbreviated "declaration" in lieu of a full-blown "notice";4 designation of particular transactions (involving certain investments by foreign governments and certain investments in critical technology U.S. businesses) as mandatorily declarable;5 extending the timelines for review of notices;6 and authorizing CFIUS to take actions including compelling parties to suspend closing while a national security review is pending,7 imposing penalties for breaches of risk-mitigation conditions,8 and charging filing fees.9 And this list is by no means exhaustive. FIRRMA contains other provisions that have attracted less commentary but are important to the day-to-day functioning of CFIUS and the advice that CFIUS practitioners give to their clients.

FIRRMA provided that implementation of its most significant innovations would be delayed until implementing regulations were adopted and necessary resources were put in place.10The statute gave CFIUS an outside deadline of February 13, 2020 (18 months from enactment) to make the necessary preparations.11 In the meantime, CFIUS issued an interim rule in

October 2018 to effectuate certain of FIRRMA's more minor changes.12 And, concurrently, it issued a second interim rule to unveil a "pilot program" (as authorized by FIRRMA) making mandatory the notification (via declaration or notice, at the option of the involved parties) of certain foreign investments in U.S. businesses that produce, design, test, manufacture, fabricate, or develop "critical technologies" utilized in or for use in one or more of 27 specified "pilot program" sectors.13

With the September 17 NPRMs, CFIUS now has revealed how it intends to implement the rest of FIRRMA (with the exception of FIRRMA's authorization to CFIUS to charge filing fees, which will be addressed in a separate rulemaking). The first NPRM deals with all investment subject to CFIUS jurisdiction other than real estate investment. It takes the form of an amendment and restatement of the CFIUS implementing regulations set forth in part 800 of title 31 of the Code of Federal Regulations (and so is referred to here as the "Part 800 NPRM"). The second NPRM deals with real estate investment and takes the form of a new part 802 of title 31 (and is referred to here as the "Real Estate NPRM"). For now, the critical technology Pilot Program Interim Rule remains in force as part 801 of title 31.

CFIUS invites written comments on both NPRMs with a deadline of October 17, 2019. As noted above, final regulations must be issued and enter into force by February 13, 2020.

A Major Increase in CFIUS Filings Expected

Before summarizing highlights of the NPRMs, it is worth noting CFIUS's expectations of the impact the new rules will have. The number of transactions notified to CFIUS has been rising steadily in recent years, approaching 250 in each of 2017 and 2018. According to the NPRMs, CFIUS expects future annual filings to include 200 non-real estate notices, 550 nonreal estate declarations, 150 real estate notices, and 200 real estate declarations that is, a total of 1,110 annual filings, or over four times the case flow of recent years.14 Needless to say, if filings meet stated expectations, CFIUS agencies will require a massive expansion of resources. And, indeed, they reportedly already have begun preparing.15

The Part 800 NPRM

"Covered Control Transactions" And "Covered Investments"

One of the most notable features of the NPRMs is how CFIUS has gone about defining the transactions over which it has jurisdiction. In the Part 800 NPRM, CFIUS re-labels what formerly was the only category of covered transaction i.e., a transaction in which a foreign person could acquire control over a U.S. business. Such a transaction now will be known as a "covered control transaction."16 The new category of covered transaction relating to certain non-controlling investments in U.S. businesses involved with critical technology, critical infrastructure, or sensitive personal data of U.S. citizens will be known as "covered investment."17 The U.S. business that is the target of a covered investment will be known as a "TID U.S. business" ("TID" being an acronym standing for technology, infrastructure, and data).18

Not every foreign investment in a TID U.S. business will qualify as a covered investment. To constitute a covered investment, the investment must not be a covered control transaction and, as provided in FIRRMA, it must give a foreign person (1) access to material non-public technical information in the possession of the TID U.S. business, (2) membership or observer rights on the board (or equivalent governing body) of the TID U.S. business (or the right to nominate an individual to such a position), or (3) any involvement, other than through voting of shares, in substantive decision-making of the TID U.S. business regarding specified activities in relation to sensitive personal data of U.S. citizens, critical technologies, or critical infrastructure.19

Moreover, to qualify as a covered investment, the target must be an "unaffiliated" TID U.S. business.20 That is, it must be a TID U.S. business in which the foreign investor does not already directly hold more than 50 percent of the outstanding voting interest or have the right to appoint more than half of the members of the border of directors (or equivalent body).21

"Excepted Investors"

The Part 800 NPRM introduces the concept of an "excepted investor" and carves out from "covered investment" an investment by a foreign person that qualifies as an "excepted investor."22 To oversimplify just a bit, an excepted investor is an investor that is a national of an "excepted foreign state," which in essence is a trusted foreign state.23 CFIUS has not yet identified excepted foreign states. In the Part 800 NPRM, CFIUS states its intention to do so in a two-step process. First, the CFIUS chair, with the agreement of two-thirds of the CFIUS voting members, will establish a list of eligible foreign states.24 CFIUS has indicated that there will be a limited number of such designations at first.25 Second, the CFIUS chair, with the agreement of two-thirds of the voting members, will determine whether an eligible state "has established and is effectively utilizing a robust process to analyze foreign investments for national security risks and to facilitate coordination with the United States on matters relating to investment security."26 If both conditions are satisfied, then a state will be an excepted foreign state. The Part 800 NPRM indicates that the second determination will not occur until two years after the effective date of the final rule.27

If an investor is an excepted investor, then its investment in an unaffiliated TID U.S. business is not a covered investment and therefore need not be notified to CFIUS even if the investor would acquire the access, rights, or involvement in substantive decision-making that ordinarily would cause an investment to be a covered investment .28 Obviously, this establishes a major benefit to being designated an excepted foreign state and for investors to be designated excepted investors and no doubt will be the subject of diplomatic engagement.

Excepted investor status becomes more complicated when it comes to investors that are entities owned or controlled by other entities. Thus, the Part 800 NPRM provides that for a foreign entity to be treated as an excepted investor it and each of its parents must meet all of the following conditions:

  • Each entity must be organized under the law of an excepted foreign state ("EFS") or the United States;
  • Each entity must have its principal place of business in an EFS or the U.S.;
  • Each member of the board (or similar governing body) must be a national of the U.S. or an EFS and not also be a national of a non-EFS;
  • Any foreign person that by itself or as part of a group of foreign persons holds a 5% or greater interest in the entity must itself meet the excepted investor nationality requirements; and
  •  The "minimum excepted ownership" of the entity must be held by one or more persons who individually or in the aggregate are either U.S. persons or meet the excepted investor nationality requirements. The term minimum excepted ownership is defined by reference to whether or not an entity's equity securities are traded on an exchange in either an EFS or the U.S. If they are, then the minimum excepted ownership is ownership entitling persons to a majority of the profits or the right upon dissolution to a majority of the entity's assets. If the entity's equity securities are not traded on an exchange in an EFS or the U.S., then the minimum excepted ownership is 90%. In other words, that is the minimum interest in an entity that must be held by U.S. persons or persons meeting the EFS nationality requirements for the entity itself to be treated as an excepted investor.29

Moreover, even if a person ordinarily would meet the definition of "excepted investor," it loses that status if it has engaged in certain enumerated infractions, such as making material misstatements to CFIUS or being found in violation of U.S. economic sanctions or export control laws.30 And even if a person is an excepted investor at the time a deal closes, if its conduct during a subsequent three-year period would cause it no longer to have that status, CFIUS may treat it as if it was not an excepted investor at the time of closing.31 In other words, based on that subsequent conduct, CFIUS may review a transaction post-closing even though a foreign investor may have relied on its excepted investor status at the time of closing and not notified the transaction to CFIUS.

"TID U.S. Businesses"

Furthermore, the identification of which businesses qualify as TID U.S. businesses is not as simple as determining whether they are somehow involved with critical technology, critical infrastructure, or sensitive personal data of U.S. citizens. Here, the Part 800 NPRM attempts to focus on particular types of businesses within this broader universe.

For example, the Part 800 NPRM elaborates on the concept of "sensitive personal data" by reference to the kind of business that maintains or collects data and the kind of data it maintains or collects. CFIUS is focused on businesses that "target[] or tailor[] products or services to any U.S. executive branch agency or military department with intelligence, national security, or homeland security responsibilities, or to personnel and contractors thereof;" businesses that maintain or collect data on greater than one million individuals; and businesses with a demonstrated objective to maintain or collect data on greater than one million individuals.32 The Part 800 NPRM delineates ten different categories of data such a business might maintain or collect that would qualify as sensitive personal data.33 Additionally, genetic information is treated as sensitive regardless of the nature of the business that maintains or collects it.34

The Part 800 NPRM also elaborates on the concept of "critical infrastructure." For purposes of determining whether infrastructure is "covered investment critical infrastructure" (but not necessarily "covered control transaction critical infrastructure") the Part 800 NPRM includes an appendix that identifies 28 different kinds of infrastructure in one column and functions related to each kind of infrastructure in an adjoining column. Infrastructure is considered to be "covered investment critical infrastructure" if it is of a kind referred to in column 1 of the appendix and an investor's involvement with that infrastructure would be of the type referenced in the corresponding entry in column 2.35 Thus, for example, a satellite or satellite system would be covered investment critical infrastructure if it provides services directly to the Department of Defense or any component thereof (as referenced in column 1 of the appendix) and the investor in question owns or operates the satellite or satellite system (as referenced in column 2). To take another example, an internet exchange point that supports public peering would be covered investment critical infrastructure if the investor in question owns and operates the exchange point.36

For purposes of covered control transactions, infrastructure is critical infrastructure if it consists of "systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems or assets would have a debilitating impact on national security,"37 which is the pre-FIRRMA definition of "critical infrastructure." This definition applies regardless of whether the infrastructure is of a type in the Part 800 NPRM appendix, and regardless of whether the investor's functions with respect to the infrastructure are of a type described in the appendix.

The Part 800 NPRM defines "critical technologies" by reference to the principal U.S. export control regimes plus "emerging and foundational technologies," which is a concept defined in section 1758 of the Export Control Reform Act of 2018 (50 U.S.C. 4817) and being elaborated in a process led by the Department of Commerce.38 An investment that affords a foreign person access to certain information, rights, or decision-making with respect to a U.S. business that produces, designs, tests, manufactures, fabricates, or develops one or more critical technologies is a covered investment under the Part 800 NPRM but not necessarily a pilot program covered investment within the meaning of the part 801 pilot program. For an otherwise covered investment to come within the pilot program and therefore be subject to a mandatory declaration (or, at the transaction parties' option, a notice) the critical technology in question must be utilized in or for use in one of the 27 pilot program activities enumerated in the appendix to part 801.39

Mandatory Declarations

The mandatory declaration provisions in the Part 801 pilot program were promulgated by CFIUS pursuant to an authorization in FIRRMA giving CFIUS the discretion to require declarations for particular types of transactions.40 Additionally, FIRRMA requires that declarations be mandatory for certain transactions in which a foreign person acquires a "substantial interest" in a U.S. business and a foreign government holds a "substantial interest" in the foreign person.41 The Part 800 NPRM defines the concept "substantial interest" for each of the two parts of this requirement. Thus, for the requirement to be triggered, the foreign person must hold a 25% or greater (direct or indirect) voting interest in the U.S. business, and the foreign government must hold a 49% or greater (direct or indirect) voting interest in the foreign person.42

In contrast to the Part 801 Pilot Program, which requires that a mandatory declaration be submitted at least 45 days before closing of a pilot program covered transaction,43 a mandatory declaration under the Part 800 NPRM would have to be submitted at least 30 days before closing.44

Voluntary Declarations

In addition to implementing FIRRMA's requirements for mandatory declarations, the Part 800 NPRM establishes the option for transaction parties to submit a voluntary declaration in lieu of a notice.45 Currently, the declaration alternative is available only to parties that are required to submit to CFIUS a declaration or notice before closing a pilot program covered transaction. When the rules proposed in the Part 800 NPRM enter into force, the declaration alternative will be available regardless of the nature of the transaction.

The Part 800 NPRM sets forth the required contents of a declaration (whether mandatory or voluntary)46 and the procedures that will be followed in conducting an "assessment" of a declared transaction.47 (Under the Part 800 NPRM, a declaration triggers an "assessment" by CFIUS, whereas a notice triggers a "review," which may be followed by an "investigation.")

As explained in our previous alert (available here), a declaration is meant to be an abbreviated submission (usually not longer than five pages). CFIUS has made available on its website a form that can be used for making a declaration.48

A possible advantage to submitting a declaration rather than a notice is that an assessment must be completed within 30 days of CFIUS acceptance of a declaration,49 whereas review of a notice may take up to 45 days, with a possible additional 45 days for investigation (and an additional 15 days in extraordinary circumstances).50 However, unlike a review or investigation, an assessment ultimately may be inconclusive. While CFIUS may clear a transaction at the end of a 30day assessment,51 it also may request the parties to submit a full notice, inform the parties of the option to submit a full notice, or self-initiate a review of the transaction.52 Parties should weigh the risks of an inconclusive result and possible additional delay in deciding whether to submit a declaration in lieu of a notice.53

Investment Fund Exception

In addition to elaborating the concept of covered investment and setting forth the requirements and procedures for declarations, the Part 800 NPRM codifies FIRRMA's investment fund exception. FIRRMA provides that even though an indirect investment by a foreign person in what the Part 800 NPRM calls a TID U.S. business otherwise would constitute a covered investment, it will not be a covered investment if it is made through an investment fund where certain enumerated conditions are met.54 The conditions are (with certain narrow exceptions):

  • The fund is managed exclusively by a general partner, a managing member, or an equivalent;
  • The general partner, managing member, or equivalent is not a foreign person;
  • The advisory board or committee of the fund on which the foreign person is a member does not have the ability to approve, disapprove, or otherwise control investment decisions of the fund, or decisions made by the general partner, managing member, or equivalent related to entities in which the fund is invested;
  • The foreign person does not otherwise have the ability to control the fund, including authorities specified in the statute;
  • The foreign person does not have access to material nonpublic technical information as a result of its participation on the advisory board or committee; and
  • The investment otherwise meets requirements set forth in the FIRRMA provisions pertaining to what the Part 800 NPRM calls covered investments.55

A similar exception pertains to FIRRMA's provision on mandatory declarations of certain investments in which a foreign government has a substantial interest.56

The Part 800 NPRM codifies the investment fund exception without elaboration,57 following the approach taken in the Pilot Program Interim Rule.58


In addition to expanding CFIUS's jurisdiction and designating certain kinds of investments as mandatorily declarable, FIRRMA expanded CFIUS's power to penalize parties for material misstatements and breaches of undertakings to CFIUS. Tools available to CFIUS now include monetary penalties (as had been the case prior to FIRRMA)59 and requiring parties to notify CFIUS of all covered transactions during a five-year period (even transactions that otherwise would be subject to only voluntary notification).60 In the Part 800 NPRM, CFIUS codifies these tools.61

The Real Estate NPRM

The Real Estate NPRM is modeled after the Part 800 NPRM and follows a similar approach with respect to key terms and procedural matters.62 What distinguishes the Real Estate NPRM is its approach to defining the kinds of real estate investments that could qualify as covered transactions and therefore be subject to CFIUS review.

FIRRMA defines the scope of real estate investments over which CFIUS has jurisdiction as encompassing private or public real estate that is in the United States and

  • Is, is located within, or will function as part of, an air or maritime port;
  • Is in close proximity to a United States military installation or another facility or property of the United States Government that is sensitive for reasons relating to national security;
  • Could reasonably provide the foreign person the ability to collect intelligence on activities being conducted at such an installation, facility, or property; or
  • Could otherwise expose national security activities at such an installation, facility, or property to the risk of foreign surveillance.63

Determining whether real estate is, is located within, or will function as part of, an air or maritime port presumably would seem to be relatively straightforward to determine. But determining whether real estate meets the other criteria that would cause an investment by a foreign person to be susceptible to CFIUS review could be more difficult without clearer guidance, and providing that guidance is the focus of the Real Estate NPRM.

Central to the Real Estate NPRM is the term "covered real estate." That term is defined to mean real estate that is, is located within, or will function as part of, an airport or maritime port, or real estate that is situated within a specified distance relative to a military installation or other facility or property of the U.S. Government.64 The installations, facilities, and properties in question are sub-divided into 16 different categories and then identified by name in an appendix.65 The appendix is divided into four parts, with most of the sites in question listed in parts 1 and 2. In general, with respect to those sites, an investment is covered if real estate is within "close proximity" meaning one mile from the boundary66 of the site.67 But if a site listed in part 2 is an army combat training center located in the continental United States, a major range and test facility base, or a military range owned by the U.S. Navy or Air Force, or joint training centers in Oregon,

Nevada, Idaho, Wisconsin, Mississippi, North Carolina, or Florida, then a different standard applies. In that case, if real estate is located within the "extended range" of the site, then an investment in that real estate is covered.68 "Extended range" means 99 miles from the outer boundary of "close proximity," but not more than 12 nautical miles seaward from the U.S. coastline.69

Part 3 of the appendix covers three Air Force base missile fields in Nebraska, Wyoming, Colorado, Montana, and North Dakota. As specified in part 3, any real estate in listed counties or parts of those counties is considered covered for purposes of the real estate NPRM.70

Finally, part 4 of the appendix covers U.S. Navy off-shore range complexes and off-shore operating areas. Any part of one of these installations within 12 nautical miles seaward of the U.S. coastline is considered covered for purposes of the real estate NPRM.71

The fact that real estate meets the definition of covered real estate does not necessarily mean that a foreign investment in it will be susceptible to CFIUS review. In addition to the real estate being covered, a foreign person must acquire at least three out of four enumerated property rights including the right--

  • To physically access the real estate;
  • To exclude others from physical access;
  • To improve or develop the real estate; or
  • To attach fixed or immovable structures or objects to the real estate.

Like the Part 800 NPRM, the Real Estate NPRM provides a carve-out for excepted investors (here labeled "excepted real estate investors"). The concept is the same. That is, following a two-step process (as described above), CFIUS will identify trusted foreign states that qualify as "excepted real estate foreign states," and foreign investors that meet the relevant nationality requirements will be treated as excepted foreign investors meaning that their investments will not be subject to CFIUS review even if they otherwise would meet the definition of covered real estate transaction.72

In addition to treating transactions by excepted real estate investors as "excepted real estate transactions" (i.e., transactions that are not "covered" and need not be declared or notified to CFIUS), the Real Estate NPRM designates certain other transactions as excepted. Consistent with FIRRMA,73 this carve-out covers (with exceptions, including a close proximity exception) transactions in urbanized areas and transactions involving single housing units.74 Additionally, the Real Estate NPRM carves out certain transactions involving real estate for use as a retail trade, accommodation, or food service establishment; commercial office space in a multi-unit commercial office building; and certain land owned by or held in trust for Native American groups.75

The Real Estate NPRM makes clear that it is meant to deal with transactions involving real estate only, as opposed to transactions involving a U.S. business that happens to include real estate along with other assets.76 Where a transaction involves investment in a business that happens to include real estate it comes within the purview of part 800 rather than part 802.77

Finally, as with the Part 800 NPRM, the Real Estate NPRM sets forth rules allowing parties to submit a declaration in lieu of a notice.78 Unlike transactions covered by part 800, there are no transactions covered by part 802 for which a declaration (or notice in lieu of declaration) is mandatory.79


The rules set forth in the Part 800 NPRM and the Real Estate NPRM are complicated and likely will be revised in response to public comments before they are finalized and enter into force by February of next year. This Alert is not meant to be a comprehensive guide to the FIRRMA implementing rules but, rather, an introduction to the highlights. In analyzing how the rules could apply to a transaction, it is important to consult the rules carefully as well as the extensive updated illustrative examples set forth in key provisions, which is another important innovation as compared with the pre-FIRRMA CFIUS regulations.