Skip to main content
September 23, 2020

CFIUS Finalizes New Export Controls Test for Critical Technology Transactions


As of October 15, 2020, the mandate for review by the Committee on Foreign Investment in the United States (CFIUS) of certain foreign investments in U.S. businesses involved with critical technologies will depend directly on a U.S. export control analysis of the underlying technology. Pursuant to a final rule published on September 15, 2020 by the Department of the Treasury, as Chair of CFIUS (the Final Rule),1 the determination of whether foreign investments in such businesses are subject to mandatory CFIUS review will no longer take into account the particular industries in which the relevant critical technologies are expected to be used.

Since late 2018, certain foreign investments in U.S. companies involved in the development, production or testing of "critical technologies" for use in particular industries have been subject to a mandatory review by CFIUS. Failure to submit to CFIUS a "declaration" about the planned investment subjects the transaction parties to potential penalties—in an amount up to the value of the transaction. 

Currently, whether a declaration must be submitted to CFIUS depends in part on whether the critical technologies with which the U.S. business is involved are destined for use in specific industries (identified by reference to the North American Industry Classification System (NAICS) codes). Under the new Final Rule, however, the specific industries factor will no longer be a determinant of whether a declaration is mandatory. Instead, as of October 15, it will be mandatory to submit a declaration if a U.S. export license or authorization would be needed to transfer the relevant critical technology to any of the foreign parties involved in the investment transaction.

The Final Rule's focus on U.S. export controls may, for investors from some foreign countries, reduce the overall number of investments subject to the mandatory declaration requirement. At the same time, it seems likely that the Final Rule will make investments from other countries, such as China and Russia, more likely to be subject to the mandatory filing requirement.

Below we provide an overview of the Final Rule, highlighting those areas where the Final Rule differs from the proposed version of the rule that was issued by Treasury in May.2


CFIUS is an interagency committee authorized to review certain transactions involving foreign investment in the United States in order to determine whether such transactions would harm the national security of the United States. CFIUS operates pursuant to section 721 of the Defense Production Act of 1950, as amended (Section 721), and the Treasury Department's implementing regulations. As amended by the Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA), Section 721 gives CFIUS authority to review both transactions that result in control by a foreign person over a U.S. business and also transactions in which a foreign person does not gain control, but attains a degree of access or influence over a U.S. business that (i) owns, operates, manufactures, supplies, or services "critical infrastructure"; (ii) produces, designs, tests, manufactures, fabricates, or develops one or more "critical technologies"; or (iii) maintains or collects sensitive personal data of U.S. citizens that may be exploited in a manner that threatens national security. These are termed "covered investments" under the CFIUS rules.

Also as amended by FIRRMA, Section 721 mandates that the parties to certain transactions file pre-closing "declarations" with CFIUS describing the transaction and factors about it that might impact on U.S. national security. Shortly after FIRRMA was passed, CFIUS initiated a "pilot program" implementing this mandate with respect to certain investments in U.S. businesses involved in the production of a "critical technology" for use in any of 27 industries, based on NAICS codes. On January 17, 2020, the Treasury Department published a final rule (the Part 800 Rule) that made permanent the prior "pilot program" mandatory declaration requirement for such investments, listing the specified 27 industries in Appendix B of the Part 800 Rule.

As noted, the new Final Rule removes the industry group element from the trigger for a mandatory filing with CFIUS in the case of "critical technology" investments, and makes the trigger depend instead on whether the critical technologies that the U.S. business produces, designs, tests, manufactures, fabricates, or develops are subject to certain U.S. export control regulations.

The New Export Controls Test

Specifically, under the Final Rule, a mandatory declaration is required for certain critical technology transactions only when the transaction involves a U.S. business that produces, designs, tests, manufactures, fabricates, or develops one or more technologies that would require "U.S. regulatory authorization" to otherwise export, re-export, transfer (in-country), or retransfer such technology to any foreign party related to the transaction if any such foreign party:

  • could directly control the U.S. business;
  • is directly acquiring an interest that is a covered investment in the U.S. business;
  • has a direct investment in the U.S. business and the change in rights of that foreign person could result in a covered control transaction or a covered investment;
  • is a party to a transaction or other arrangement that is designed or intended to evade or circumvent FIRRMA; or
  • individually holds, or is part of a group of foreign persons that in the aggregate holds, an applicable "voting interest," which is defined as "a voting interest, direct or indirect, of 25 percent or more."

"U.S. regulatory authorization" is defined as a license or other approval from the U.S. Department of State under the International Traffic in Arms Regulations (ITAR), a license from the Department of Commerce under the Export Administration Regulations (EAR), an authorization from the Department of Energy under 10 CFR part 810 (other than the general authorization described in 10 CFR § 810.6(a)), or a specific license from the Nuclear Regulatory Commission under 10 CFR part 110. The Final Rule provides that, for purposes of determining whether such a "U.S. regulatory authorization" is required, a foreign person's nationality will be determined based on: if the foreign person is an organization, its principal place of business, and if the foreign person is an individual, such individual's nationality or nationalities.

The determination of whether "U.S. regulatory authorization" is required does not take into account license exemptions under the ITAR or most license exceptions under the EAR. In other words, whether a declaration is required for a "critical technology" transaction is a function of how the critical technology is classified under the relevant export regulations and the corresponding licensing requirements for the nationalities of the foreign parties referenced above, generally without regard for whether a license exception or exemption could be used to facilitate a transfer without obtaining an authorization from the government. However, certain EAR exceptions will be considered to create exemptions from the mandate for a declaration to CFIUS; specifically, the EAR exceptions related to the transfer of broadly available technology (License Exception TSU), encryption items (License Exception ENC), and higher controlled items and technology authorized to be transferred to close allies without a specific U.S. government approval (License Exception STA).

Thus, under the Final Rule, whether a declaration must be submitted to CFIUS regarding a covered investment involving one or more critical technologies depends on whether a U.S. government authorization would be required to export, re-export, transfer (in country), or retransfer the relevant critical technology or technologies to any of the foreign parties to the transaction (and certain foreign persons up the ownership chain). The change from CFIUS's prior approach of taking into account the industries in which the critical technologies are intended to be used may mean that fewer investments by foreign persons from countries closely allied with the United States will be subject to a mandatory declaration requirement.  For investors from other countries, the change in approach may mean more filings will be required. For example, a Dutch investment in a U.S. manufacturer of certain electronic devices may no longer be subject to a mandatory filing requirement because the electronic devices could be exported to the Netherlands under one of the EAR license exceptions that applies under the rule. However, a Chinese investment in a U.S. manufacturer of advanced computer numerical controlled (CNC) manufacturing equipment designed for use in an industry not covered by the existing rule, may now be subject to the mandatory declaration requirement, because many CNC machines are controlled for export to China.

The Final Rule also refines the definition of "substantial interest," a term that relates to the FIRRMA requirement for filing declarations with respect to transactions that will convey a substantial interest in a U.S. business to a foreign person in which the national or subnational governments of a single foreign state have a substantial interest. To clarify how the "substantial interest" criterion would apply in the case of an investment by a foreign entity whose activities are primarily directed, controlled, or coordinated by a general partner, managing member, or equivalent, the Final Rule provides that the national or subnational governments of a single foreign state will be considered to have a "substantial interest" in such foreign entity only if such governments hold at least 49% of the interest in the general partner, managing member or equivalent of the foreign entity. Likewise, the Final Rule refines how to calculate an indirect ownership interest.

Clarifications Under the Final Rule

Although the Final Rule remains largely consistent with the proposed rule issued last May, the Final Rule provides some key clarifications. The clarifications include:

  • Timing for Mandatory Declarations Involving Critical Technology. Responding to concerns regarding when parties should determine whether "critical technology" is involved in a transaction, Treasury included in the Final Rule an express requirement that parties assess the presence of critical technologies when the transaction meets any of CFIUS' general applicability rules. Practically, under the Final Rule, this means that parties should assess whether a mandatory declaration is required at an earlier stage in the transacting process rather than at closing—such as when the parties establish the material terms of the transaction in a binding agreement. Moreover, in the occasional situation where, for example, the parties have assessed a proposed transaction for possible CFIUS requirements, and then U.S. export regulations change before closing, the parties should do another assessment.
  • "Eligibility" for EAR License Exceptions. As noted above, mandatory declaration requirements do not apply if the critical technology involved in a transaction is eligible for certain EAR license exceptions. The Final Rule clarifies the meaning of "eligible" for applicability of these license exceptions to the mandatory declaration requirement. For example, the EAR permits parties to self-classify certain encryption items, and that self-classification is sufficient for an item to be eligible for License Exception ENC. As a result, assuming all other requirements have been met, a mandatory declaration will not be required if the U.S. business' only critical technologies are self-classified in accordance with License Exception ENC.3 By contrast, for certain encryption items described in 15 CFR 740.17(b)(2) and (b)(3), a party must submit a classification request to the Commerce Department's Bureau of Industry and Security and observe a 30-day waiting period to be eligible for the License Exception ENC. Therefore, the CFIUS exception to the mandatory declaration requirement would not apply unless a classification request is submitted in accordance with the procedures set out in 15 CFR 740.17(b)(2) and (b)(3).

The Final Rule's treatment of "eligibility" for License Exception ENC may have a significant impact for businesses that develop or modify encryption software as part of a services-based operating model but do not normally export it. For these businesses, the encryption software involved will not qualify for License Exception ENC (and will therefore be subject to CFIUS' mandatory filing requirements) until the relevant requirements under the EAR are met. Accordingly, parties should consider classifying their software in order to meet License Exception ENC even if they have no plans to export it.


By focusing CFIUS' mandatory declaration requirement for covered investments in critical technologies on existing export control regulations, the Final Rule aligns CFIUS' consideration of national security risks with respect to such investments with evolving U.S. export control policies. This will help facilitate foreign investment from countries that are treated favorably under existing U.S. export controls, while potentially requiring more CFIUS filings with respect to investment from others. In short, and when taken together with CFIUS's new "excepted investor" provisions for investors from certain favored countries,4 the Final Rule suggests a further bifurcation of the level of scrutiny CFIUS gives to foreign investors based on their nationality.

© Arnold & Porter Kaye Scholer LLP 2020 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.

  1.  85 Fed. Reg. 57124 (Sept 15, 2020).

  2. See Arnold & Porter Advisory,"CFIUS Proposes Rule to Align Certain Mandatory Filing Requirements With Export Control Regulations" (May 22, 2020).

  3. The final rules also distinguish between "eligibility" for the use of a relevant license exception prior to, as opposed to following, an export (even if no export is to occur). For example, critical technologies that have been properly self-classified will not trigger CFIUS’ mandatory filing requirements regardless of whether the U.S. business has complied with the applicable reporting requirements under EAR Section 740.17(e).

  4. See Arnold & Porter Advisory, "CFIUS Finalizes Rules Implementing Its Expanded Jurisdiction to Review Foreign Investment in US Businesses" (Jan. 17, 2020).