Legal Alerts/22 Oct 2020

Changes to Mandatory CFIUS Disclosure Also Effect Finnish Companies

The mandatory disclosure regime of the Committee on Foreign Investment in the United States (CFIUS) has been amended – certain fairly substantial changes took effect on October 15, 2020 when the so called “Final Rule” came into force.

The Final Rule changes the requirements for mandatory disclosures, shifting the review process from an industry-based focus to a regulatory authorization analysis. The changes will add complexity for the involved transacting parties, who should prepare for additional complexity, costs, and delays. The Final Rule may affect diligence, transaction structure, negotiations, transaction timelines, and deal certainty, which transacting parties can mitigate through the steps outlined below.

In the US, CFIUS is authorized to review certain transactions involving foreign investment in the US, in order to determine the effect of such transactions on US national security.

Why CFIUS matters and key changes

CFIUS has authority to suspend, modify, or prohibit a transaction within its jurisdiction in order to address a national security concern. If a transaction has already been completed, CFIUS has the authority to unwind the transaction through a forced divestiture. CFIUS also has jurisdiction over indirect acquisitions and divestments.
Significant changes to requirements for making mandatory disclosures. Disclosures are mandatory where the US business would require a US government authorization in order to export, reexport, or transfer its products or technology to certain categories of foreign investors or buyers.
Shift the focus from an industry-based consideration to a regulatory authorization analysis. This creates additional complexity for Finnish investors in or acquirors of certain US companies, as well as Finnish parties divesting from certain US companies.
More detailed and time-consuming analysis required. Parties may no longer simply look at the industry in which the US business operates, but, instead, must have a clear grasp of the complex regulatory authorization regimes This additional level of complexity will require more comprehensive diligence and is more time-consuming than previously.

About the changes

Background to changes

CFIUS is an interagency body within the US federal government. It consists of members drawn from a variety of US government agencies, including, among others, the Departments of Treasury, State, Energy, Commerce, and Defense. CFIUS considers the national security implications of a transaction within its jurisdiction on the basis of three elements: threat, vulnerabilities, and consequences.

Threat refers to the intent and capability of a foreign person to take action to impair US national security.
Vulnerabilities are extent to which the nature of the US business presents susceptibility to impairment of US national security.
Consequences refer to the consequences to US national security resulting from the exploitation of the vulnerabilities by the foreign threat actor.

Traditionally, CFIUS had jurisdiction over transactions that could result in a foreign investor gaining direct or indirect control of a US business. However, the Foreign Investment Risk Review Modernization Act of 2018 (“FIRMA”) was enacted by Congress in 2018 to address gaps in the US government’s ability to monitor and remedy national security risks posed by foreign investments in and acquisitions of US businesses. FIRMA expanded CFIUS jurisdiction to cover noncontrolling, nonpassive foreign investments in US business involved in critical technology, critical infrastructure, or sensitive personal data about US citizens (“TID US businesses”). FIRMA also made it mandatory for transacting parties to submit disclosures to CFIUS with respect to certain foreign investments in TID US businesses that are involved in critical technology. If a mandatory disclosure is required but not made, CFIUS is authorized to impose civil fines on the transacting parties in amounts up to the total value of the contemplated transaction.

Mandatory Disclosures

The Final Rule modifies the requirements for submitting a mandatory disclosure to CFIUS. Previously, mandatory disclosures were required when the US business receiving investment or being acquired utilized or designed critical technology in certain industries (e.g., biotechnology, nuclear power, missile and space vehicle manufacturing, etc.). With the Final Rule in effect, CFIUS disclosures are mandatory where the US business receiving investment or being acquired would require a US government authorization in order to export, reexport, or transfer its products or technology to certain categories of foreign investors or buyers. Under the Final Rule, transacting parties may no longer simply look at the industry in which the US business operates, but, instead, must have a clear grasp of the complex regulatory authorization regimes administered by the Departments of State, Commerce, Energy and the Nuclear Regulatory Commission. This additional level of complexity will require more comprehensive diligence of both the US business and the foreign investor or acquirer.

Regulatory Analysis

The application of a regulatory analysis approach to the CFIUS disclosure regime creates a number of difficulties for transacting parties.

First, export control analyses are focused on the export of specific items under specific circumstances. Export analyses of similar items do not always consistent results. Moreover, an export analysis is limited to items actually being exported. Under the regulatory analysis approach to CFIUS disclosure, US companies will need to consider the export compliance of technologies developed solely for internal use that bear little connection to the commercial end product.
Second, foreign investors must be prepared to assess and disclose their upstream ownership structure prior to a transaction. The regulatory authorization analysis requires an assessment of both foreign direct investors investing in a TID US business and any foreign individual or entity who individually holds, or is part of a group of foreign persons that holds, a direct or indirect voting interest of at least 25% in a foreign direct investor.
Third, export control analyses are time-consuming, often lasting weeks or months, and may not fit easily into a transaction timeline. Finally, different investors in a US business may reach different CFUIS outcomes. Under the previous industry-focused regime, foreign investors receiving the same rights in a US business had, under almost all circumstances, the same CFIUS filing requirements. Under the regulatory authorization regime, foreign investors will have different CFIUS filling responsibilities based on the investors’ nationalities. For example, Finnish investors and Chinese investors will certainly receive different outcomes, making the upstream ownership structure review especially important if a Finnish acquiring or investing entity has foreign owners.

Conclusion

Now that the Final Rule has come into effect, US companies and Finnish investors and acquirors must live with the regulatory authorization regime for mandatory CFIUS disclosures. Transacting parties should be prepared for additional costs, risk, and delays to their plans. The Final Rule may affect diligence, transaction structure, negotiations, transaction timelines, and deal certainty. Transacting parties can mitigate some of these concerns by conducting exporting control classification and foreign person analyses prior to negotiating a deal sheet. Transacting parties are further advised to consider passive foreign investments where possible, so as to avoid triggering mandatory CFIUS filings. If a mandatory filing is unavoidable, transacting parties should work without one another and counsel to agree on a mutually beneficial path forward.

Borenius’ lawyers are available to assist in addressing any questions you may have concerning these changes and their effects on your business.