The Foreign Investment Risk Review Modernization Act
Final regulations were issued by the U.S. Department of the Treasury on January 17, 2020, implementing the Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA). These regulations amend the rules governing the Committee on Foreign Investment in the United States (CFIUS), which reviews transactions involving foreign investment in U.S. businesses for national security risks.
Here is a summary of the key provisions. Executives taking on investment from abroad will particularly want to take notice, but any business involved in transactions that could compromise the national security of the United States will need to demonstrate a willingness to comply with these regulations.
1. Expanded CFIUS Jurisdiction
FIRRMA broadens CFIUS’s authority to review “covered transactions,” which now include not only transactions resulting in foreign control of a U.S. business but also certain non-controlling investments in U.S. businesses involved in critical technologies, critical infrastructure, or sensitive personal data (collectively referred to as “TID U.S. businesses”—Technology, Infrastructure, and Data).
2. Critical Infrastructure
The regulations define critical infrastructure as systems or assets vital to U.S. national security, such as energy, telecommunications, or transportation systems. A U.S. business qualifies as a TID business if it performs specific functions related to 28 types of critical infrastructure listed in Appendix A, like operating or providing security for facilities such as crude oil storage with significant capacity.[](https://www.quinnemanuel.com/the-firm/publications/article-january-2020-what-cfius-final-regulations-mean-for-businesses/)
3. Critical Technologies
The rules incorporate mandatory declarations for transactions involving U.S. businesses that develop or use critical technologies in 27 targeted industries. Critical technologies include items on the U.S. Munitions List, certain export-controlled items under the Commerce Control List, and other sensitive technologies. This integrates a prior CFIUS pilot program requiring mandatory filings for such transactions.
White Shoe law firm Quinn Emanuel has more.
4. Sensitive Personal Data
The regulations cover U.S. businesses that maintain or collect sensitive personal data of U.S. citizens, which could be exploited to threaten national security, such as financial, health, or geolocation data.
5. Mandatory Declarations
Certain transactions, particularly those involving critical technologies or substantial foreign government interests, require a mandatory declaration to CFIUS before closing. These declarations are shorter filings (compared to full notices) to facilitate CFIUS review.
6. Excepted Foreign States and Investors
The regulations introduce the concept of “excepted foreign states” (e.g., close U.S. allies like Australia, Canada, and the UK) and “excepted investors” from these states, who may face less scrutiny for certain transactions due to their alignment with U.S. security interests. The list of excepted states is published on the Treasury’s website.
7. Non-Controlling Investments
CFIUS can now review non-controlling investments that grant foreign persons access to material nonpublic technical information, board membership, or decision-making rights in TID U.S. businesses.
8. Real Estate Transactions
While not the focus of this document, FIRRMA also extends CFIUS jurisdiction to certain real estate transactions near sensitive U.S. government facilities, though this is not detailed extensively in Part 800.
9. Definitions and Clarifications
The regulations provide detailed definitions, such as for “covered control transaction,” “foreign entity,” and “completion date” (the date ownership or rights are transferred). They also clarify terms like “critical infrastructure” and “critical technologies” to guide compliance. More available here.
10. Implementation and Effective Date
The regulations took effect on February 13, 2020, replacing prior CFIUS rules. They reflect public comments received on proposed rules and integrate lessons from the 2018 pilot program. These regulations strengthen CFIUS’s ability to protect U.S. national security while balancing the need to maintain an open investment environment. They provide clearer guidance for businesses and investors on compliance, particularly for transactions involving sensitive sectors.
Contact us for more information on how to make your competitive strategy compliant with Federal regulations.
