On November 18, 2024, the U.S. Department of the Treasury (“Treasury”) issued a final rule (the “Final Rule”) that amends the regulations administered and enforced by the Committee on Foreign Investment in the United States (“CFIUS” or the “Committee”).[1]  In particular, the Final Rule “enhance[s] certain CFIUS procedures and sharpen[s] its penalty and enforcement authorities” in order to ensure its investment screening regime “has a sharper scalpel to more quickly and effectively address national security risks that arise in CFIUS reviews.”[2]  The Final Rule remains largely consistent with Treasury’s April 4, 2024 Notice of Proposed Rulemaking (the “Proposed Rule”), with a few adjustments in response to public comments.[3]  Substantively, the Final Rule makes these six changes:  (i) expands the types of information transaction parties and other persons may be required to provide to CFIUS; (ii) allows the CFIUS Staff Chairperson to prescribe a time frame within which transaction parties must substantively respond to mitigation proposals; (iii) broadens the circumstances in which CFIUS may use its subpoena authority; (iv) expands the circumstances in which a civil monetary penalty may be imposed due to a party’s material misstatement or omission; (v) extends the time frame for submission of a petition for reconsideration of a CFIUS-imposed penalty; and (vi) significantly increases the maximum civil monetary penalties parties may face for violations of the CFIUS statute and regulations, as well as agreements, orders and conditions authorized thereunder.[4]

DETAILS OF THE AMENDMENTS MADE BY THE FINAL RULE

A.    Requests for Information

Pursuant to the Defense Production Act of 1950, as amended (the “DPA”), and its implementing regulations, CFIUS is tasked with identifying transactions that may be subject to CFIUS jurisdiction (“covered transactions”) for which no notice or declaration has been submitted (“non-notified transactions”) and which may raise national security considerations.  Prior to the Final Rule, CFIUS regulations provided that CFIUS may request the parties to a non-notified transaction to provide the information necessary for CFIUS to determine whether the non-notified transaction is in fact a covered transaction, and if so, may request the parties to file a notice of such covered transaction.  The Final Rule expands the scope of the information CFIUS may request from parties to a non-notified transaction to include information beyond jurisdictional information, including whether the transaction may raise national security considerations and whether the transaction meets the criteria for a mandatory filing with CFIUS.  The Final Rule makes clear that CFIUS asserts authority in this context to request information not only from the transaction parties, but also from “other persons.”  Corresponding amendments to related provisions expressly obligate transaction parties or other persons to provide the requested information.[5]

The Final Rule further expands the circumstances in which parties are required to provide information to CFIUS to include circumstances where CFIUS seeks information to (i) enable it to assess compliance with the DPA and CFIUS regulations, (ii) monitor compliance with, or enforce the terms of, a mitigation agreement entered into, condition imposed or order and (iii) determine whether a party made a material misstatement or omission in any prior submission to CFIUS.[6]

In expanding the scope of information parties may be required to provide to the Committee, the Final Rule also expands CFIUS’s subpoena authority to cover that information.  The Final Rule makes a related amendment to the existing regulations to provide that CFIUS may obtain information from parties to a transaction or other persons through subpoena or otherwise “if deemed appropriate,” as opposed to “if deemed necessary,” as the regulations previously provided.[7]  Under the Final Rule, when determining if a subpoena to a third party is appropriate, CFIUS will consider “the nature of the transaction and transaction parties as well as the information that CFIUS needs to obtain.”[8]

B.    Negotiation of Mitigation Agreements

The CFIUS regulations prescribe time frames within which parties must respond to CFIUS’s requests for additional information during the course of its review of a notified transaction (two business days in the case of a declaration filing and three business days in the case of a notice filing).  Prior to the Final Rule, the regulations did not contemplate a time frame within which parties must respond to CFIUS’s initial proposal of, or revisions to, mitigation terms.  Emphasizing the importance of parties’ timely responses to enable CFIUS to complete an investigation of a transaction within the time prescribed by statute, the Proposed Rule would have required parties to substantively respond to proposed mitigation terms or revisions thereto within three business days, subject to a request by the parties for an extension, which the Staff Chairperson could grant on a case-by-case basis.[9]  The Proposed Rule emphasized the particular importance of this time frame in the context of reviews of closed transactions, where “timing is critical for [CFIUS] when it has identified an extant risk to national security, but parties may be less motivated to respond promptly given the absence of an impending closing date.”[10]

In response to public comments advocating that a three-day period provided insufficient time to adequately consider and respond to mitigation measures proposed by CFIUS, the Final Rule moved away from a fixed three-day time frame for responding to mitigation measures in favor of a more flexible approach.  Instead, the Final Rule provides that “the Staff Chairperson may impose a time frame of no fewer than three business days on a discretionary basis in consideration of certain factors identified in the regulations.”[11]  When determining whether to impose a time frame, the Staff Chairperson may consider, among other factors, (i) the statutory deadline for completing an investigation, (ii) the risk to national security arising from the transaction, (iii) the parties’ responsiveness to the Committee, and (iv) the nature of the transaction.  In addition to providing for the discretionary imposition of a time frame to respond to mitigation proposals, the Final Rule provides that CFIUS may reject any voluntary notice at any time after the notice has been accepted if a party fails to substantively respond to a mitigation proposal in the time period specified.

C.    Civil Monetary Penalties

The Final Rule increases the maximum penalty amount that CFIUS may impose on a party for violations of the DPA or the implementing regulations as follows:

*  The Proposed Rule noted that CFIUS anticipates that this indication will be given for requests for information related to non-notified transactions, failure to file a mandatory declaration, and compliance with, or enforcement, modification or termination of, a mitigation agreement, condition or order.

The Final Rule notes that the maximum penalties are not specified by statute, and that the current maximums were implemented over 15 years ago.  Treasury indicated that its assessment was that existing maximums were not a sufficient deterrent or penalty in support of the decision to increase them.[12]  The Final Rule emphasizes that the increase will not affect CFIUS’s discretion to determine the appropriate penalty in individual cases, and notes that CFIUS will continue to take into account the specific facts and circumstances of the violation and relevant aggravating and mitigating factors identified in CFIUS’s Enforcement and Penalty Guidelines.[13]

The new maximum penalty amounts apply to material misstatements or omissions or failures to file mandatory declarations that occur on or after the effective date of the Final Rule and to violations of mitigation agreements entered into, conditions imposed and orders issued on or after the effective date of the Final Rule.

Finally, the Final Rule extends the time frame for parties to submit a petition in response to a penalty notice, as well as for CFIUS to assess the petition and issue a final penalty determination, in each case from 15 days to 20 days.

OBSERVATIONS

Overall, the Final Rule is consistent with CFIUS’s increased focus on monitoring and enforcement since the passage of the Foreign Investment Risk Review Modernization Act of 2018.  While the expansion of the scope of information that transaction parties are expressly required to provide when requested by CFIUS seems unlikely to have a significant practical impact (as transaction parties will typically respond to CFIUS requests for information regardless of whether the requested information is expressly required by the CFIUS regulations), it does allow for a corresponding expansion of the circumstances in which parties may face civil monetary penalties for material misstatements or omissions in submissions and other communications to CFIUS, and the Final Rule also expands the subpoena authority, which seems especially relevant with regard to situations where CFIUS may seek information from non-parties.  The increase in the maximum penalty amounts underscores the importance of compliance with CFIUS regulations—including the submission of mandatory filings, adherence to mitigation conditions and the provision of complete and accurate information to CFIUS in all circumstances—by increasing the potential consequences of failing to do so, and significantly so with regard to violations of material provisions of mitigation agreements, material conditions imposed by CFIUS or orders issued by CFIUS, where penalties could be assessed at the value of the U.S. asset at the time of the violation.  The expansion of the regulations to expressly cover requests for information from “other persons” (in addition to transaction parties) in the non-notified transaction context is another notable indicator of CFIUS’s continued and increasing focus on the identification of non-notified transactions that may raise national security concerns.

The Final Rule will become effective on December 26, 2024.

ENDNOTES

[1]           U.S. Department of the Treasury, Final Rule Modifying Provisions Related to Penalties, Obligation to Provide Information, Negotiation of Mitigation Agreements, and Other Procedures Pertaining to Certain Investments in Businesses in the United States and Certain Transactions by Foreign Persons Involving Real Estate in the United States (Nov. 18, 2024) (hereinafter, Final Rule), available at https://home.treasury.gov/system/files/206/CFIUS-Final-Rule-November-2024.pdf.

[2]           U.S. Department of the Treasury, Press Release, Treasury Issues Final Regulations to Sharpen and Enhance CFIUS Procedures and Enforcement Authorities to Protect National Security (Nov. 18, 2024) (hereinafter, Final Rule Press Release), available at https://home.treasury.gov/news/press-releases/jy2716.

[3]           Amendments to Penalty Provisions, Provision of Information, Negotiation of Mitigation Agreements, and Other Procedures Pertaining to Certain Investments in the United States by Foreign Persons and Certain Transactions by Foreign Persons Involving Real Estate in the United States (Apr. 11, 2024) (hereinafter, Proposed Rule), available athttps://home.treasury.gov/system/files/206/Notice%20of%20Proposed%20Rulemaking%20-%20April%2011%202024.pdf.

[4]           Final Rule Press Release.

[5]           According to the Final Rule, this “preliminary fact-finding” with respect to non-notified transactions can inform CFIUS’s decision as to whether and when to request a notice, thereby helping to “focus the transactions the Committee requests for filing, benefitting both transaction parties and national security.”  Final Rule at 7.

[6]           The requirement to provide information with respect to a potential material misstatement or omission applies to “[a]ny person that has submitted information to the Committee.”  Final Rule at 24.  The Proposed Rule emphasized that this covers submissions made during the course of any “previously concluded review or investigation (including a review or investigation that ended with rejection of the parties’ notice).”  Proposed Rule at 8.

[7]           The Proposed Rule explained that requiring CFIUS to determine the appropriateness of a subpoena, rather than the necessity, aligns with the criteria of section 705 of the DPA, which provides that the subpoena authority may be used only after the scope and purpose have been defined by competent authority and assurance has been obtained that no adequate and authoritative data are available from any Federal or other responsible agency.  The Final Rule further explains that the subpoena authority may only be used in furtherance of determining “whether a transaction is a covered transaction, whether it may raise national security concerns such that the Committee should review it (if it is a covered transaction), and whether the transaction is of a type for which submission of a declaration was mandatory.”  Final Rule at 5.

[8]           Final Rule at 6.  The Final Rule notes that “[t]he Committee can envision situations in which it would seek information from third persons such as banks, underwriters, or service providers to transaction parties.”  Id.

[9]           The Proposed Rule explained that CFIUS “expects a substantive response to consist of acceptance of the terms, a counterproposal, or a detailed statement of reasons that the party or parties cannot comply with the proposed terms, which may also include a counterproposal.”  Proposed Rule at 9.

[10]         Proposed Rule at 9.

[11]         Final Rule at 11.  

[12]         The Proposed Rule noted that “from 2013 to 2022, the median value of covered transactions filed with CFIUS pursuant to a joint voluntary notice was $170 million, with numerous transactions valued in the billions.  For covered transaction declarations filed from 2018 (when declarations became an available format for submission) to 2022, the median value was over $38 million.”  Proposed Rule at 11.

[13]         See CFIUS Enforcement and Penalty Guidelines, available at https://home.treasury.gov/policy-issues/international/the-committee-on-foreign-investment-in-the-united-states-cfius/cfius-enforcement-and-penalty-guidelines.  For additional information regarding the Enforcement and Penalty Guidelines, see our Memorandum to Clients entitled CFIUS Enforcement and Penalty Guidelines Issued (Oct. 26, 2022), available at https://www.sullcrom.com/insights/memo/2022/October/CFIUS-Enforcement-and-Penalty-Guidelines-Issued.

This post comes to us from Sullivan & Cromwell LLP. It is based on the firm’s memorandum, “Treasury Amends CFIUS Procedures and Enforcement Authorities,” dated December 4, 2024, and available here.