On Tuesday, Congress released its final draft of the Foreign Investment Risk Review Modernization Act (FIRRMA)—a compromise bill which reconciles the differences between the versions previously passed by the House and Senate. This version accordingly is likely to become law within the next several weeks. FIRRMA will significantly expand the jurisdiction and reform the process of the Committee on Foreign Investment in the United States (CFIUS). While many FIRRMA provisions will require implementing regulations to become effective, and those regulations might not be finalized for many months, investors and businesses will need to prepare for FIRRMA now.

Below, we provide a high-level summary of key aspects of the bill—some of which have changed since our last report—and provide four questions that U.S. businesses and investors should be asking themselves today:

1. Are my foreign limited partners insulated from information access and governance, whether or not my fund is itself foreign?
2. Am I a critical technology, critical infrastructure, or sensitive data company subject to increased CFIUS scrutiny?
3. When will I be required to declare transactions to CFIUS under the new mandatory filing rules?
4. Am I prepared for an extended timeline for my next foreign investment?

The FIRRMA Basics

Wilson Sonsini summarized the original November 2017 draft of FIRRMA here and provided a further update on the final Senate draft here. While the final version of the bill has stepped back from some of the most dramatic expansions of CFIUS authorities contemplated in the original draft, the key changes to CFIUS authorities remain very similar:

• Expanded CFIUS jurisdiction will cover not only foreign parties' acquisitions of control over U.S. businesses, but also (a) certain real estate acquisitions and leases and (b) many non-controlling investments into critical infrastructure companies or those that service them; businesses that develop, make, or test critical technologies; and companies that maintain or collect personal data of U.S. citizens.
• Short-form declarations will permit parties to apply to CFIUS for a preliminary decision in 30 days in order to help determine whether a full review is necessary.
• CFIUS declarations will become mandatory for (a) transactions in which a foreign entity takes a substantial interest in a U.S. business, when a foreign government also holds a substantial interest in that foreign entity and (b) a subset of CFIUS-specified transactions involving critical technology companies.
• Filing fees may be put in place for some or all transactions, and significant additional funds will be allocated to all CFIUS member agencies for CFIUS-related reviews.
• Transactions that are not voluntarily notified to CFIUS (so-called "non-notified transactions") may be subject to increased scrutiny when CFIUS establishes a FIRRMA-mandated process for collecting information on non-notified transactions.

In sum, CFIUS will soon have the jurisdiction, resources, and statutory mandate to review a broader swath of foreign investment into U.S. businesses. The CFIUS agencies will pay particular attention to foreign investment in the critical infrastructure, critical technology, and sensitive data sectors.

The FIRRMA Transition Timeline

FIRRMA leaves many provisions and terms in the legislation, such as "critical infrastructure" and "substantial interest," open for further interpretation in the implementing regulations. Those regulations can be expected to take months to develop and will be subject to notice and comment by interested parties. Accordingly, it may take a year or longer before there is clarity regarding the new regulatory framework and a set of accepted practices for companies and investors involved in cross-border transactions.

Nevertheless, some changes will take effect immediately. In particular, FIRRMA extends the initial CFIUS review period from 30 days to 45 days. Moreover, FIRRMA grants CFIUS the right to implement a subset of the proposed changes that require regulatory interpretation under a "pilot program" with only 30 days' notice. Even if no pilot program is implemented, the countdown to a new foreign investment regime will start as soon as the bill is signed.

Four Big Questions for Investors and Companies

With that timeline in mind, here are four initial questions that investors in U.S. businesses, or U.S. business interested in foreign investment, should consider now in light of FIRRMA:

1. For Investors: Are my foreign limited partners insulated from information access and governance, whether or not my fund is itself foreign?

Over the last few years, CFIUS has paid increasing attention to the ability of foreign limited partners to exercise control over investing entities. While FIRRMA expands CFIUS's ability to investigate fund investments, including the investments of U.S. funds, it also for the first time establishes statutory guidance for determining which foreign investments are truly passive, generally insulating such passive investments from CFIUS jurisdiction.

FIRRMA lays out several components of this passivity exemption, which can be applied when a limited partner's participation in a fund through a committee or advisory board might otherwise constitute control for CFIUS purposes. An exempt fund must, among other requirements: (i) be managed exclusively by a general partner that is not a foreign person; (ii) not grant control over decision-making of the fund to a foreign person or any committee on which a foreign person sits; and (iii) not grant the foreign person access to material nonpublic technical information.

U.S. funds with foreign investors will need to craft their limited partnership agreements and committee membership practices in order to satisfy this passivity exemption and avoid CFIUS review of their investments. Existing funds with foreign limited partners that intend to continue investing in U.S. businesses may want to consider amending the relevant agreements.

Key Considerations: Does the investing fund satisfy each prong of the exemption test? Do its agreements with limited partners document its ability to satisfy each prong?

2. For Companies: Am I a critical technology, critical infrastructure, or sensitive data company subject to increased CFIUS scrutiny?

Companies considering taking foreign investment should evaluate whether they are likely to fall into these categories once CFIUS issues final regulations. All will be subject to increased scrutiny under FIRRMA. Critical technology companies may also be required to make declarations—mandatory CFIUS filings—when proposing to accept foreign investment.

A critical technology company is a business that "produces, designs, tests, manufactures, fabricates, or develops" critical technologies. Critical technologies, in turn, are those subject to certain U.S. export and other security controls, including new export control provisions designed to protect "emerging and foundational technologies." Early indications from the U.S. government suggest that companies that work in artificial intelligence, robotics, biotechnology, and similar industries may ultimately be considered purveyors of these newly covered technologies.

A critical infrastructure company, meanwhile, is any business that "owns, operates, manufactures, supplies, or services" critical infrastructure. Historically, the U.S. government has considered telecommunications, utilities, transportation, financial services, health care, and government services all to be critical infrastructure, among many others.

Sensitive data companies are those that "maintain or collect" sensitive data on U.S. citizens that may be exploited in a manner that could threaten national security. This category is the least defined within FIRRMA, although recent CFIUS practice suggests that a broad range of data is likely to be considered to fall under the designation, and that companies ranging from advertising firms to insurers may be considered holders of sensitive data.

Key Considerations: Does the target company work with export-controlled technologies or with other advanced technologies that may become controlled under the new export control regime? Does its activity include production, design, testing, manufacturing, fabrication or development? Does it support or own any critical infrastructure? Does it collect or otherwise access sensitive information about U.S. citizens?

3. For Both: When will I be required to declare my transactions to CFIUS under the new mandatory filing rules?

New mandatory filing rules will require implementing regulations, so the timing is uncertain. FIRRMA will require mandatory declarations to CFIUS in two cases. The first includes those transactions in which a foreign entity takes a substantial interest in a U.S. business, when a foreign government also holds a substantial interest in that foreign entity. The regulations will further explain what constitutes a "substantial interest," but FIRRMA does establish two statutory carve-outs. Both (a) investments below a 10 percent voting interest and (b) investments through an exempt interest in an investment fund are not to be considered substantial interests. Foreign government investors, such as sovereign wealth funds and businesses considering accepting investment from such investors, may want to consider establishing investment vehicles that operate pursuant to these carve-outs.

CFIUS has the authority to define a second set of mandatory filings in the forthcoming regulations, subject only to the limitation that the cases that are required to file must involve a critical technology company in some capacity. FIRRMA again establishes a carve-out in this second case for investments through an exempt interest in an investment fund.

Key Considerations: Is there a foreign state-owned entity involved in any potential future investment, including as a limited partner in an investing fund? Is the target company a critical technology company, or does it support critical technology companies? Can the investment be structured through an exempt fund?

4. For Both: Am I prepared for an extended timeline for my next foreign investment?

While most of FIRRMA will not take effect for several months, at the earliest, there are several ways in which the most significant changes may nevertheless impact the timing of potential foreign investments being contemplated today. Examples include:

• The FIRRMA-related resources that will be injected into CFIUS immediately will correspondingly increase the likelihood that CFIUS will take notice of transactions that have not been voluntarily filed and will compel filings for such transactions. Accordingly, for many transaction parties, foregoing a CFIUS review will be riskier than in the past as CFIUS continues to hire. Those parties increasingly may defer closing until they receive CFIUS clearance.
• The pilot program provision permits CFIUS to apply its expanded powers as soon as signing occurs, as long as it provides 30 days' notice of the rules and specific targets associated with that pilot program in the federal register. Likely pilot program targets—e.g., companies in critical technology and critical infrastructure industries and foreign-government-backed investors—may want to accelerate planned investment in order to avoid any early pilot restrictions.
• FIRRMA will apply in full—including mandatory filing rules, extended jurisdiction, and filing fees—to any transaction "proposed, pending, or completed" within thirty (30) days after Treasury indicates that the new regulations and related CFIUS resources are in place. While that indication may not come for months, current or near-future transactions may not have closed by the time Treasury indicates the new rules are ready. Any such transaction that has not filed at CFIUS under the current regime will become subject to the new rules while the transaction is still pending.
• Companies with a long-term plan to raise equity capital through foreign investment on an as-needed basis may need to engage in additional advance planning. FIRRMA permits CFIUS to require a mandatory declaration up to forty-five (45) days in advance of the closing of an investment. Parties that may be subject to the mandatory declaration rules, such as critical technology companies, may not be able to access foreign capital without this regulatory delay.

Key Considerations: Is it possible to accelerate existing plans for a proposed foreign investment? Will the proposed foreign investment potentially close several months in the future?

The national security practice at Wilson Sonsini Goodrich & Rosati will provide a further update on FIRRMA and more details on the expected timeline when the bill is signed. For more information about FIRRMA or any other CFIUS-related matter, please contact Stephen Heifetz (sheifetz@wsgr.com); Joshua Gruenspecht (jgruenspecht@wsgr.com); or any member of the national security practice at Wilson Sonsini Goodrich & Rosati.