CFIUS & VC: 3 Takeaways from the Final Rules and What Investors Must Know

The Treasury Department recently released the long awaited final rules implementing the Foreign Investment Risk Review Modernization Act (FIRRMA), and they go into effect February 13, 2020. Through FIRRMA, Congress gave CFIUS significant new powers to police investments into certain U.S. companies and has made CFIUS highly relevant in the startup ecosystem. CFIUS’s power was demonstrated in recent high-profile cases that forced Chinese investors to divest of holdings in Grindr, PatientsLikeMe, and Musical.ly. The combination of CFIUS interest in data rich companies and their expanded authority over non-controlling investments means the agency will be a player in the startup ecosystem going forward.

NVCA has been at the table on behalf of the venture industry during the legislative and rulemaking processes and the final rules reflect sustained advocacy by NVCA. 3 key takeaways for VCs have emerged from the final rules:

• Expanded pool of companies:VCs will witness more portfolio companies that are wrapped up in CFIUS considerations—whether through actual filings or diligence to determine if a filing is necessary. Investments by foreign entities into companies with “sensitive personal data” may now be subject to CFIUS jurisdiction; that’s in addition to companies dealing with critical technology and critical infrastructure as required under the Pilot Program. What constitutes “sensitive personal data” is detailed in the final rules and fortunately was pared back from the proposed rules. Not so fortunately, this pool stands to grow even further as the Commerce Department identifies “emerging or foundational” technologies.
• New details on relationship with foreign LPs and investors:FIRRMA protects passive investment by foreign LPs into funds and the accompanying final rules provide further guidance on how U.S. fund managers can avoid a CFIUS filing. For example, the final rules give helpful guidance on what constitutes “material nonpublic technical information” (disclosure of which could cause a mandatory CFIUS filing); how U.S. funds organized outside the laws of the U.S. can prevent the fund from being considered a foreign entity; and treatment of foreign LPs on Limited Partner Advisory Committees.
• Direct investments:Foreign entities investing directly into startups in covered technologies will be impacted more so than U.S. funds with foreign LPs. That’s because if a foreign entity investing directly takes a board seat or gains access to sensitive technical information about the company (to name just two triggers) then a CFIUS filing could be required.  Compare that with a U.S. fund manager who also takes a board seat or gains access to sensitive information, but that access and information does not flow to her foreign LPs.  This dynamic will impact U.S. companies raising capital from foreign VC funds; corporate VC groups with foreign parents; or foreign individuals or family offices.

Details from these takeaways are below, as well as a run down of how the final rules addressed important venture equities that NVCA has been advocating on for more than two years.

Basic structure unchanged

Since the Pilot Program went into place in November 2018, many VCs and startups have grown accustomed to the basic structure of when a CFIUS filing may be required for non-controlling investments (see #3 in a previous blog of mine). That structure is largely mandated by FIRRMA’s text and the CFIUS final rules provide important color and explanation.

Foreign entity

NVCA has focused on two areas that are wrapped up in the foreign entity definition. First, we sought to ensure that U.S. VC funds organized outside the laws of the U.S. (e.g. Cayman fund) are not considered to be a foreign entity. Second, we pushed for clarity that non-U.S. general partners of a venture fund will not make an otherwise U.S. fund into a foreign entity.

We were very pleased to see Treasury address our concerns around funds organized outside the U.S. Under present CFIUS rules, if an entity can establish that its “principal place of business” is in the U.S. then it will not be considered a foreign entity. Making that demonstration is tricky for a fund, as it does not have a legal headquarters in the way a corporation does. As recommended by our formal comments, CFIUS has set forward a definition of principal place of business that focuses on where the entity “directs, controls, or coordinates” activity (so-called nerve center test), which will be helpful to venture firms organized under the laws of another country but that run the firm in the U.S. (§800.238). However, CFIUS added one caveat: the regulations say that if an entity has asserted to the government that its principal place of business is offshore then the fund cannot claim that its principal place of business is in the U.S. for CFIUS purposes. We are working to understand the impact of this subsection but are hopeful this will not erode the benefit of the new principal place of business definition.

The new principal place of business test is an Interim Rule, meaning it goes into place on February 13 along with the final rules, but Treasury has invited parties to comment on the new definition. Look for NVCA to provide formal comments on the definition to make sure it works for VCs.

NVCA has also been focused on obtaining guidance for venture funds with non-U.S. partners that are concerned the fund may be considered a foreign person under CFIUS rules. Our comments sum up the concern like this:

For funds with a subset of foreign general partners, the question is whether those partners’ minority share of the vote in fund operations constitutes “control” over their funds, making those funds “foreign persons.” [] Why is NVCA concerned that a minority of foreign GPs would constitute foreign control? Under traditional CFIUS interpretations of control, one or two members of a board of directors appointed by an investor from a foreign country can, at CFIUS’s discretion, put a corporation under foreign “control.” This is true even if those directors represent a distinct minority of that board. If that same logic were to hold true in the fund context, many funds with a U.S. place of business and a majority of U.S. based investment partners, but a few foreign general partners, would be considered “foreign persons” subject to CFIUS review.

To our disappointment, the final rules do not address this common scenario. As a result, venture firms are left without clear guidance on how to evaluate their firms “foreign-ness” because of non-U.S. GPs. Venture investors are advised to consult counsel on their specific situation.

Sensitive personal data

The statute gave CFIUS jurisdiction over investments into companies with “sensitive personal data” of U.S. citizens (§800.241).  If that sounds like a new concept, that’s likely because this aspect of the statute was not included in the Pilot Program, but CFIUS has implemented that requirement in the final rules.  NVCA encouraged CFIUS to narrow the scope of what is “sensitive personal data” and the final rules appear to make changes to the proposed rules in several important ways. Still, this new category of companies will be one that sweeps in many venture-back startups. What Treasury considers to be sensitive personal data includes companies with financial information that could be used to analyze or determine an individual’s financial distress or hardship; data relating to the physical, mental, or psychological health condition of an individual; or geolocation data collected using positioning systems, cell phone towers, or WiFi access points such as via a mobile application, vehicle GPS, other onboard mapping tool, or wearable electronic device.

Here are four nuances you should understand:

1. Of particular interest, CFIUS has recalibrated the provision dealing with “genetic information” in a very helpful direction and has limited it to the “results of an individual’s genetic tests.”
2. Treasury provided an example that may help companies determine whether a company has a “demonstrated business objective to maintain or collect data” of individuals (Example 5 from §800.241). The key learning: a company telling investors it intends to get sensitive data may not be enough to have a “demonstrated business objective” but taking business action in pursuit of acquiring that data may be enough.
3. The final rules are focused on sensitive personal data that is “identifiable,” which is important as NVCA had raised concerns that “de-identified” data does not present the same national security challenges (i.e. a person’s identity is not attached to the data).
4. To trigger the sensitive personal data prong, the company must have data of more than one million individuals (note: not U.S. citizens) over a 12-month period. The final rules provide some helpful examples of how that 12-month period is calculated and how data from various categories can be aggregated to get to 1 million.

Definition of “material, nonpublic technical information”

As U.S. VCs manage relationships with foreign LPs, VCs must take care they do not share “material nonpublic technical information” with foreign LPs that might cause a mandatory CFIUS filing (§800.232). In fact, in the NVCA Model Legal Documents “LPA Insert Language for CFIUS,” we specify that a foreign LP will not “obtain or seek to obtain access to Material Non-public Technical Information of the Partnership or any Portfolio Investment.” But what is material nonpublic technical information?

In the context of investments into critical technologies, FIRRMA defines material nonpublic technical information as that which is “not available in the public domain and is necessary to design, fabricate, develop, test, produce, or manufacture a critical technology, including processes, techniques, or methods.” NVCA’s view, reflected in our comments on the proposed rules, is that the statute appears to “capture the concept of reverse engineering” but due to an absence of clarity “[m]any venture investors have become concerned that information such as nonpublic technical milestones…is also covered.”

Ultimately, Treasury did not limit the term to reverse engineering, but the final rules provided two illustrative examples that may help VCs and startups navigate the rules (see §800.232, examples 1 and 2). Under the first example source code is determined to meet the definition and under the second example a company milestone (absent technical details) is determined not to meet the definition. These examples likely spring from direct advocacy by NVCA members sharing their experience in navigating the Pilot Program.

As a reminder, due to NVCA’s advocacy, the statute specifies that the definition does not include financial information of an entity. Taken together, the financial information carveout and the two examples in the final rules paint a clearer picture for VCs on how to manage their relationship with foreign LPs.

Excepted investor concept

NVCA has been the leading organization advocating that CFIUS establish an “Excepted Investor” process that exempts certain investors from U.S. allies from the jurisdictional expansion over non-controlling investments. We partnered with other industry organizations on a proposal on how to structure the Excepted Investor process and advocated for including an array of allied countries, including NATO countries and other blocs.

Under the Excepted Investor concept included in the final rules, to be an Excepted Investor an entity must be closely connected to an “Excepted Foreign State” and meet certain requirements.

CFIUS has initially selected Australia, Canada, and the United Kingdom as excepted states. NVCA certainly would have liked to see a far more expansive group of countries included, though we are pleased to see relief for certain investors from these countries. Treasury notes in the final rules that it may expand the country list in the future and we are hopeful that additional countries can be added in the future to alleviate CFIUS issues for foreign investors that may be co-investing with U.S. VCs or supporting VC-backed companies in later stage rounds. One thing to look out for: Treasury will look closely at a country’s foreign investment screening process when determining whether it ought to be an Excepted Foreign State. This will motivate countries to create CFIUS-like regimes in their own countries, which could further slow cross-border investment.

Importantly, be aware that it is not enough just to hail from an Excepted Foreign State; investors from these countries are exempted from the expansion of jurisdiction to non-controlling investors only if they can meet the other requirements under the Excepted Investor concept (detailed at §800.219). For example, 75% of the entity’s board members and observers and all of its 10% or greater shareholders must be a U.S. person or from an excepted foreign state, in addition to other requirements. An Excepted Investor must self-certify that it is excepted, and the consequence of getting it wrong are that an investor may miss a mandatory filing. And there are big reasons to worry about missing a mandatory filing: possible forced divestment from the U.S. company and being fined up to the value of the investment. That is huge motivation for parties to take the Excepted Investor analysis seriously.

What’s next?

The final CFIUS rules are by no means the end of the road in terms of how foreign investment scrutiny will impact venture and startups. The ecosystem will need to make adjustments to comply with these requirements, including providing time for government approval of a transaction. NVCA will also remain vigilant on the “emerging or foundational” technologies rulemaking, which stands to open the aperture of companies that may be subject to CFIUS filings and cause many VC-backed companies to be subject to export controls for the first time (including restrictions on foreign nationals working at startups). VCs and entrepreneurs can continue to count on NVCA to be their voice in Washington on this policy issue for many years to come.