What to Know about CFIUS

with @mikeleiter @katie_haun What does the Committee on Foreign Investment in the U. S. (CFIUS) and updates to the Foreign Investment Risk Review Modernization Act (FIRRMA) mean for founders taking investments from or doing joint ventures with foreign entities or just doing business globally in general? What does and doesn't CFIUS cover, and how might one structure partnerships strategically as a result?

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Speaker 00

  The content here is for informational purposes only, should not be taken as legal, business, tax, or investment advice, or be used to evaluate any investment or security, and is not directed at any investors or potential investors in any A16Z fund. For more details, please see A16Z.com/disclosures.

• 0:17Sonal?

  Hi, everyone. Welcome to the A6Z Podcast. Today's episode is all about CFIUS, the Committee on Foreign Investment in the United States, and their proposed updates to FERMA, or the Foreign Investment Risk Review Modernization Act of 2018, which took place in September 2019. The conversation was hosted by Andreessen Horowitz as part of an event for founders and others, with general partner Katie Hahn interviewing Michael Leiter, a partner at law firm Scat and Arps et al., who covers national security, cybersecurity, and privacy, CFIUS, and more, which is what this Q and A is all about, covering what it involves and doesn't, to how to think about and structure your business and partnership strategically as a result. But the conversation begins with what CFIUS is.

• 0:59Speaker 02

  So, CFIUS stands for the Committee on Foreign Investment in the United States. And the basic function of CFIUS is to review any foreign investment in a US business that produces national security concerns. So, that sounds relatively basic. It's this big interagency body. Everything in Washington is interagency, but...

• 1:19Speaker 03

  And how many agencies?

• 1:21Speaker 02

  Thirteen agencies. It's run by the Department of Treasury, unsurprising, because it's about foreign investment in the United States. And it has traditionally sort of split between two different camps. Historically, it was those parts of the US government that wanted foreign investment in the United States, Treasury, the US Trade Representative, State Department, like, their job is to do this. And those agencies that didn't necessarily want investment were at least more concerned about security. So, thank the Department of Defense, Department of Justice, now Homeland Security, and elements of the intelligence community. Central Intelligence Agency, NSA, organizations like that, FBI. So, once upon a time, we were really, really worried about the semiconductor industry

• 2:06Speaker 02

  moving from the United States to Japan. So, CFIUS was fundamentally created to start to limit that movement of technology from the US to Japan, and that was generally being done through limiting Japanese acquisition of certain businesses here in the United States. So, that's now pretty ancient history. Fast forward to when Katie and I were in government, 2006, what is CFIUS concerned with then? It's post 9/11. Dubai Ports World decides that they want to buy American ports. Washington says, "Wait, that has to be bad, too." So, in post 9/11 era, CFIUS honestly focuses on things like that, worrying about critical infrastructure and the Emiratis buying that.

• 2:51Speaker 02

  Fast forward to today, and the joke I often use is although it's the Committee on Foreign Investment in the United States, largely, it's Chinese foreign investment in the United States. And what has changed is not just that political lens, but what's really changed and what starts to really affect, I hate to say it, all of you, is the changes in technology, the expansion of data, the ability to use data in a huge variety of ways that was never present 20 or 30 years ago, 10 years ago. Now means that the US government is focused on a huge range in fundamentally every sector of society. So, CFIUS is not limited to technology.

• 3:36Speaker 02

  It's not limited to aerospace and defense and military technology. It's true, not everything is covered by CFIUS, but you have to assume it is if you're involved in technology. You touch data. You own any real estate, you do any work with the US government, or you have anything else. You can even get into the world of, you know, dog food. Ooh, do the seals buy dog food from you for their bomb-sniffing dogs? So there's no limitation on the sector, there's no limitation on the size of the deal.

• 4:11Speaker 03

  You mentioned that this all kind of came about during the Japanese semiconductor era, but now it's undergone some reforms and then some new implementing proposed regulations. So I want to talk about those reforms. But before I do, you just mentioned data. What about verticals like fintech or crypto companies who might have PII?

• 4:31Speaker 02

  Yeah, so really, we've seen this for several years now about a focus on personally identifiable information. And CFIUS has looked at this through a very broad lens. So once upon a time, it was, again, if I knew everything about Katie in one place, maybe CFIUS would care.

• 4:48Speaker 03

  You probably do.

• 4:49Speaker 02

  I do. And I have stories for you. So there are a number of things that have happened which have really highlighted how sensitive CFIUS is about data that is collected. First of all, there's this thing called cybersecurity. And what we've seen over the past, again, five to 10 years, is obviously not just the ubiquity of data, but the key vulnerability of data across every sector. And we've seen countries, especially China, Russia, and otherwise others, use cyber attacks and cyber penetrations for their benefit. And not just their national security benefit, but also their economic benefit. Everyone remember the OPM hack, Office of Personnel Management?

• 5:30Speaker 02

  So if you start to put these pieces together, you understand how foreign adversaries can take advantage of lots and lots of data in different places and piece that together. So in terms of fintech, all financial information, that's been a clear area of focus for CFIUS. Now, the good news is these new regulations do sort of carve out standard consumer credit card information as an area of specific concern. But beyond that, they specifically cite things like credit reports, broader financial data. So I think anyone in this sector, working in fintech, is inevitably going to have more than just your, you know, 16-digit credit card number, and that will absolutely be considered sensitive data to CFIUS.

• 6:18Speaker 02

  CFIUS also in its newest regulations try to say, okay, well, it's not really everything. It's only if you have a lot of it. Everyone remember Austin Powers, how much money he asks for? You know, $1 million? And they're like, guys, $1 million isn't a lot. So what did CFIUS come up with for the number of people's personal data? 1 million people. It's not a joke, it really is. And it's not even if you have a million people's data. It's if you have a stated business purpose to get to a million people. Who here doesn't? So again, these are draft regulations, but it gives you a sense of, to some extent, the dichotomy between how you're seeing business, how you're trying to grow a business,

• 7:02Speaker 02

  and how, from a Washington national security perspective, everything starts to get encompassed.

• 7:08Speaker 03

  And also, financial technologies, as you know, I have a real interest in crypto. Obviously, I want to talk a little bit about how CFIUS reforms could affect the crypto industry. I'll save that for later. In our discussion of what is a US business, and indeed, in the context of crypto, what is even a business at all? But tell us about the reforms. Like, what are, what's new? And why are we hearing about CFIUS so much more?

• 7:35Speaker 02

  I think we've seen two major factors which have driven everyone listening about CFIUS. Chinese are a global competitor for the United States, they're also a global partner in some ways, certainly in investment and technology. But stated Chinese policy is about being a global competitor on a bunch of technological fronts. And that really motivated the Congress to be fearful of China and start to limit Chinese influence in US business, which brought about one of the only bipartisan things that has happened over the past three years, which was reform of CFIUS. So that was kind of the driving impetus for it. What did it actually change? A couple of things. First, CFIUS has always been purely voluntary.

• 8:16Speaker 03

  Can you, can you unpack that a little bit? What do you mean purely voluntary?

• 8:19Speaker 02

  Yeah, so if Alibaba shows up and buys one of you tomorrow, prior to CFIUS reform, it was up to you and Alibaba to go and actually submit something to CFIUS or not. And that did mean that the vast majority of transactions were never seen by CFIUS. Every once in a while, CFIUS would go out and grab and pull a company in. But again, there was no requirement to ever present your matter. And when you present a matter to CFIUS, it's fundamentally the two parties coming together. You describe the U.S. business, you describe the foreign acquirer, you describe the transaction, the motivation for the transaction, and there's a process whereby CFIUS reviews that for national security concerns.

• 9:00Speaker 02

  And CFIUS can then either say, "You're good," CFIUS can say, "You're very, very bad, and we're going to ask the president to block it," and the president can, under his Article 2 authority, block the transaction from occurring. Or what happens most often in sensitive transactions is that CFIUS says, "Well, you can do the transaction, but we're going to impose some mitigation to reduce the national security risk." And that can mean a lot of things. That can be a separate board of U.S. citizens overseeing the company, it could be limitations on access to technology, controls over the data, all sorts of things. So that's how CFIUS always operated. People came to CFIUS, presented their transaction, and one of those three things generally happened.

• 9:43Speaker 03

  Since it was voluntary, did you see companies that would have otherwise fallen under the jurisdiction of CFIUS saying, "I want to fly under the radar"?

• 9:53Speaker 02

  Absolutely. So it happened all the time that people wouldn't actually go to CFIUS. So especially smaller transactions. I mean, you have a big market transaction, and it's all over the front page of the Financial Times, the Wall Street Journal, a little harder to fly under the radar, but for a long time, especially on smaller transactions, it wasn't occurring. Now, why even go then, if it's voluntary? Because there's no statute of limitations on CFIUS. So if you don't go to CFIUS, at any time, the U.S. government can knock on your door and say, "Hey, Katie, that deal you did three years ago, we want to investigate that deal." And ultimately, CFIUS has the authority to force divestiture, unwind the transaction,

• 10:37Speaker 02

  or impose mitigation. And if you're a company and you're taking money or you're buying something, that's a pretty uncomfortable place to be for the rest of time. And especially if you're a company that is doing other transactions in the United States. It gets harder and harder to just say, "Ah, let's not worry about it." But the reforms, again, did several things here that have changed this. First, there are pieces of CFIUS that are now mandatory.

• 11:05Speaker 03

  So not voluntary?

• 11:06Speaker 02

  Not voluntary, and if you don't show up, you can be fined up to $250,000 or the value of the transaction. And so it's just like any other compliance scheme at that point, export control, something else. Now, that's not every transaction, but it does involve a lot of what people in the Valley do. In particular, it's mandatory if the company operates in a certain sensitive sector that's listed by CFIUS, and if you produce or design export-controlled technology.

• 11:36Speaker 03

  That sounds like military stuff, but it's not just that, right?

• 11:40Speaker 02

  Exactly. It's not just military stuff. It's also a huge range of other things that are controlled by the Commerce Department as dual-use technology. So what does that include? Things like encryption. Your software has a certain level of encryption, your software is export-controlled, that means if there's an investment in that company over a certain size or giving that foreign investor certain rights, it's a mandatory filing with CFIUS.

• 12:06Speaker 03

  What other kinds of things for companies that you see out in the Valley would be relevant that now, under these new reforms, would be covered?

• 12:13Speaker 02

  Yeah. So today, it's certain sensors, so LiDAR, for example. The high-end types of LiDAR defined by a certain wavelength for distance, those are controlled. LiDAR that you use for your standard autonomous vehicle, test projects now, not controlled. So it turns out that the export control regime actually covers fundamentally everything that anyone makes, and you either get classified under what's known as EAR 99, not export-controlled, or if there's something more sensitive about the technology, it can be export-controlled to certain countries for national security. So it ranges from computing power...

• 12:55Speaker 02

  Battery storage, sensors, it's everything. Now, if you're doing straight software, it tends not to unless you get into the world of encryption.

• 13:07Speaker 03

  Can you talk a little bit more about that and about what now I know as part of the reforms are if it's a sensitive technology?

• 13:13Speaker 02

  Yeah, so.

• 13:14Speaker 03

  How is that defined?

• 13:15Speaker 02

  Yeah, there are kind of three stages. I've talked a lot about the historical, all the just voluntary stuff. Then we had the reform in 2018, which starts to really edge more into this world of sensitive technology, which is if it's export controlled and you work in a certain sector, mandatory. The reform continues because this is Washington, so the law was passed in 2018. There are still regulations being promulgated to implement that law. And those are the draft regulations you mentioned that came out. Ongoing throughout that, there is also a reform of all US export control. And this is where I think a lot of people are going to be affected in the valley more than ever before. The Commerce Department is now defining what it means to be foundational and emerging technology.

• 14:00Speaker 02

  Exactly what foundational emerging is still to be defined, but if your technology falls into that TBD category, and that should be out in the next four to six months, then any transaction there puts you back into that mandatory bucket. So what are the areas of foundational emerging technology that we know the US government is most focused on? Artificial intelligence, machine learning, autonomy, right?

• 14:27Speaker 03

  What about like sensors?

• 14:28Speaker 02

  So very, very high-end battery technology has always been sensitive. And the export control rules literally get down to how much battery storage do you have for the weight? What's the weight to storage capacity? So this is all quite purposeful, what is going on. This is not an accident because the view is in Washington and from CFIUS that our global competitors, in particular China, Have focused on early-stage startups who are developing technology or the engine of innovation in our society, coming in early as investors, getting access to that technology. It's not being reviewed for national security purposes, and eventually that technology is

• 15:09Speaker 02

  moving across to foreign companies and, in some cases, foreign militaries. There's actually a very strongly worded, pretty powerful article in the Wall Street Journal about Chinese civil military cooperation and investments in U.S. companies. But we are now in a place where, in terms of reforms, some more stuff is mandatory, more stuff is going to become mandatory. Now, one thing we didn't talk about is CFIUS is not any investment.

• 15:39Speaker 03

  Yeah, so what's covered?

• 15:41Speaker 02

  So first of all, you have, think about it as kind of at least two things, and then there's a plus. One is, there's got to be a U.S. business. A U.S. business is somebody in the U.S. who's engaged in interstate commerce. There's not a whole lot more definition than that. It doesn't matter if it's, say, a French company that has a U.S. office and they're doing business in the U.S. If someone goes to buy that French company, CFIUS has nothing to do with that French acquisition, but it still gets to look at, if it wants to, the U.S. element of that transaction.

• 16:17Speaker 03

  So effectively, what you're saying is you don't need to be a Delaware corporation?

• 16:20Speaker 02

  Exactly.

• 16:21Speaker 03

  You just have to be doing business in the U.S.

• 16:23Speaker 02

  You have to be doing business here. Now, that does mean if you're just selling assets, you're not selling a business, as a general matter, that's not covered. By the way, it also doesn't affect greenfield investments, so foreign company can come here, start, you know, flatten a lot in Palo Alto, build everything, start everything on their own. No CFIUS, except maybe the real estate. We're not going to worry about that for now. Second, it's got to be a foreign business, right? You've got to have a foreign person making the acquisition or the investment. And what does it mean to be foreign? So, U.S. business bought by another U.S. business, but the U.S. business has a foreign parent? That's foreign. So CFIUS looks to the ultimate parent and the ultimate ownership of...

• 17:07Speaker 02

  The acquirer or the investor. So foreign private equity, foreign venture capital, that's all foreign.

• 17:14Speaker 03

  And you said acquisition, but this does importantly come up with investments too, right? So it doesn't need to just be an acquisition.

• 17:21Speaker 02

  Straight acquisition is easy. That's definitely CFIUS. Traditionally, CFIUS was only about controlling transactions. What does controlling mean to you, Katie, as someone in venture?

• 17:31Speaker 03

  That you have a vote on a board, you have more than 51%,

• 17:35Speaker 02

  there's a... You have more than 51%. For CFIUS, controlling for CFIUS purposes. So again, you have to have a controlling investment by a foreign person in a US company. Controlling for CFIUS, more than 9.9% equity. Or less than 9.9% equity with some other indicia of control. So 8% in a board seat, controlling investment. So it can be...

• 18:03Speaker 03

  What in addition to board seats are indicia of controlling investments?

• 18:07Speaker 02

  So anything in a commitment letter, side letter, MOU, which suggests some ability, decision-making authority beyond standard minority protections. That's kind of the general rule. But it gets even better, guys. One of the big changes in CFIUS, in the reform, it was always about controlling. So again, it was a pretty low bar, 9.9%. That's not what anyone normally thinks about control, but in this case it is. The reform adds an entire category of non-controlling investments. If you're involved, if your business does technology, we've already talked about what that means to be involved in critical technology. If you're involved in critical infrastructure, and that's a really detailed list we won't

• 18:49Speaker 02

  go through, or if you are a data company, remember a data discussion, all those different categories, 1 million, that sort of thing. If you're any of those, even a less than 10% investment in you, if the foreign investor has board seat, board observer, ability to influence decision-making or control decision-making...

• 19:17Speaker 02

  Or if they have access to material, non-public technical information. Any of those things, they can be at 2%. If you're a data company, they get some technology information, that's a covered investment. So, what you've seen, again, I think you've now seen most of the movie, which is it starts with this relatively narrow swath of defense technology information, and it has now moved into even small investments, if there are certain rights. In almost everything that occurs here, there's at least a voluntary filing, and more and more, there are also some mandatory filings.

• 19:59Speaker 03

  So, mandatory filings, I'm sure CFIUS and the government have a nimble process for reviewing all of these mandatory filings they're now going to have?

• 20:08Speaker 02

  When I think US government, I think nimble.

• 20:10Speaker 03

  Yeah.

• 20:11Speaker 02

  Nimble, agile.

• 20:12Speaker 03

  Okay, so, we know about what historically the process has been. I guess you don't know what it's been, the review process with these new reforms, and presumably a lot more transactions being submitted. What was the historical process?

• 20:24Speaker 02

  Yeah, so historically, the process has been, we estimate in most cases, about four to six months, start to finish. Now, if you're in the Valley, four to six months is like life or death. Obviously, larger deals, it actually tends to align relatively well with things like Hart-Scott-Rodino antitrust, so it isn't always a huge problem in larger deals, but for smaller deals it is. And that four to six months constitutes kind of from sign to close. You're prepping the documents, you're sending the documents to CFIUS, they review it, there's a back and forth, they finally accept it formally, so that whole thing takes sort of a month. The acceptance, they then review it for 45 days. At the end of that 45 days, they can say, "You're good."

• 21:08Speaker 02

  Or they can say, "Actually, we need 45 more days of investigation." You go into a second 45 days. At the end of that, then they can say things, "You're good. We're going to send it to the president." Or what they often do if it's a really hard case is, "We're not quite there. We think, we'd like you to restart the clock." And you go through another 45-day period. So that's the traditional construct, four to six months. It's post-signing. Some of it can be done pre-signing. The problem is inevitably, pre-signing, you can get some of your ducks in a row. But there's certain information that the parties just aren't willing to exchange yet. Not to mention, pre-signing, people are actually still trying to get to signing. So getting anyone's attention to do some of this is a challenge. But I do want to come back to what should absolutely be done, pre-signing.

• 21:52Speaker 02

  Because even if you're not filing, there's an enormous amount of thought that should go into that, so you don't end up in a CFIUS ditch. The four to six months is not exactly nimble. So they created that traditional process called a notice. They created what is known as a short-form declaration. And a declaration is no more than about five pages. It's a web form. It's pretty easy. There's a 30-day timeline for review. So in the valley, that's actually relevant. We just got to a place where they, we hope they will have voluntary filings like that, voluntary declarations. We don't have that yet. But that means that if you start a little bit before signing, getting stuff done, you

• 22:34Speaker 02

  spend a couple of weeks post-signing, realistically, you have probably a 45-day process. Again, it's a 30-day review process itself, where the government has to give you an answer. But realistically, you obviously need some time before that to get your information together and file it. So that's good. You can do it in a shorter timeframe. The bad news is, CFIUS doesn't have to give you an answer at the end of that.

• 23:00Speaker 03

  And so then, aren't you stuck in some kind of limbo?

• 23:02Speaker 02

  Then, well, you are stuck in limbo, but in reality, what we tell most of our clients, if CFIUS can do the, what we affectionately call, the shrug. Eh, up to you what you want to do next. They don't clear you. They don't tell you have to file a notice. And it's totally up to you on what you want to do. But the good news is, in most cases, that shrug means, go away, we have more important things to do. So you no longer get that safe harbor. They can always come back to you later. But what's the likelihood of that occurring? Really, really small. So the shrug, in most cases, is good enough for government work.

• 23:39Speaker 03

  I want to ask you one thing. What if someone wants to challenge CFIUS and say no? Can people do that?

• 23:45Speaker 02

  Yeah.

• 23:46Speaker 03

  Because in most contexts with government agencies, you have a right of judicial review, but CFIUS is different.

• 23:51Speaker 02

  CFIUS is different. If you've been a litigator before and you never want to litigate anything again, you're pretty much safe in CFIUS land. CFIUS provides a very, very, very narrow judicial review provision. You can't challenge the national security determinations. You can challenge on sort of due process grounds. There has been one, yes, count it, one challenge in federal court in CFIUS's history, which did, in fact, it involved the acquisition of some wind turbines in southern Washington State. And that established the requirements for due process, that CFIUS has to tell the parties what its concerns are to the extent it can.

• 24:35Speaker 02

  But unlike every other regulatory environment, the ability to challenge CFIUS in court is extremely narrow. So the bottom line is, you have to get what you can out of the regulatory process. And it does make for, honestly, a very different sort of negotiation than you see in most contexts, because the US government may not hold all the cards, but it holds, you know, 51 of them.

• 25:01Speaker 03

  And how does the CFIUS body, do they vote? I mean, what if some of the entities of the 13 don't care about a transaction or an investment and then others do? How does that work?

• 25:13Speaker 02

  Yeah, so it's a little bit like a jury. You got to be unanimous. But if you have one holdout, you're just, you just keep going. So it's all on consensus. If one person keeps saying, "I want mitigation," you're still stuck in this loop of trying to work through mitigation. So you can't get cleared unless everyone agrees. You probably won't get rejected unless everyone agrees too. But it can be a very challenging fight about consensus. And part of what we do with clients all the time is think about the technology, thinking about the acquirer, because CFIUS comprises 13 different agencies. And those different agencies have very, very different concerns. And sometimes, we as CFIUS lawyers with our clients

• 25:56Speaker 02

  want to spend a lot of time with the Department of Defense because it's something they care about. Sometimes, we know the Department of Defense doesn't care at all. We want to spend all our time with DOJ or NSA on different pieces. And it's, part of the art is identifying which agencies care about it and trying to make sure that as you're going through the process, not only are they not an impediment, but the ones who have the biggest interest in the US government are actually advocates for the deal getting done.

• 26:22Speaker 03

  We've been talking about acquisitions. I want to talk a little bit about investments.

• 26:26Speaker 02

  I talked about those mandatory categories on that critical technology piece. If you have export control technology. The draft regulations add one more thing that's mandatory, that if a, there's a foreign government-controlled transaction in those technology, infrastructure, or data spaces. And a foreign government-controlled transaction is a foreign investment of 25% or more in the US business by an entity that is 49% or more controlled by a foreign state. GIC, Sovereign Wealth Fund for Singapore, the issue may or may not be, if they make a 25% investment in any of those types of companies, that also drives a mandatory declaration.

• 27:11Speaker 02

  So that's going to change. Change the environment a little bit for some of the ever-present sovereign wealth funds and related entities and their investments in the Valley as well.

• 27:20Speaker 03

  What if those sovereign wealth funds are LPs in venture capital funds?

• 27:24Speaker 02

  So, the way it's written now, in terms of a JV, sovereign wealth funds in a joint venture and they have 49% of the joint venture. In most cases, a sovereign wealth fund probably wouldn't be 49% LP. The LP piece, this gets pretty complicated because you're combining two things. The analysis on whether it's foreign government-controlled and also the analysis on whether or not the LP should even be considered as an investor or just the GP. Because if it's just an LP and that LP doesn't have certain decision-making rights, then you don't consider that LP at all. So, this is another way in which, for funds, it becomes very, very important to look at

• 28:06Speaker 02

  LP agreements and determine what rights you want to provide and what rights you don't want to provide. So, we're seeing more and more excerpts of LP agreements which say, under no circumstances will the limited partners have access to material, non-public tactical information. Because if they did, ah, they no longer get the LP protection. So, it's taking some of the language and some of the art of what goes on at CFIUS, inserting that into the LP agreement and looking very carefully at the provisions around the advisory committees, the investment committees for the LPs. And in general, LPs want this. Because LPs are a joint fund, so they're not the investor. So, this is basically just verifying they're passive.

• 28:47Speaker 02

  Now, the one complication you get in larger investments, of course, is direct investment by that same LP. That's covered in CFIUS. They don't get to skate free of that because they were an LP in another fund.

• 28:59Speaker 03

  Well, a lot of founders, they're not yet kind of at the stage of later stage or growth investments. How should they be thinking about CFIUS reforms? I mean, they might have not yet a million users for their product or service, but aspire to it. And maybe they want to go raise money for a variety of reasons, not just here in Silicon Valley, but outside of the US. How should they be thinking about something like CFIUS? They might be, you know, at Series A, they might not have a general counsel or a huge legal budget for outside counsel such as yourself. What should those founders?

• 29:34Speaker 02

  So even if you don't have a general counsel, talk to the Katie Hans of the world, say, all right, if I take this money from this foreign investor, how's that going to affect my round? What rights do I have to make sure are or not involved? How's that going to affect future business opportunities? That's really important. So think strategically. Of course, it can be very attractive to take, you know, 5, 10, 15 million dollars, 12%, 15%, whatever it is, from a foreign investor who can write a big check and isn't asking for much.

• 30:07Speaker 03

  Or who provides some strategic.

• 30:09Speaker 02

  That's right, or strategic benefit for geographic diversity. I mean, all sorts of reasons. Think it through. And I'm not saying don't do it, but potentially limit certain information rights.

• 30:19Speaker 03

  So you're a specialist in coming up with innovative deal structures. Maybe you trip into CFIUS, maybe you don't. If someone didn't want to, what kind of things would you tell a Series A or Series B founder if they said, I want to take foreign investment, but I really don't want to go through this, what sounds like a not nimble and a fairly paper-intensive CFIUS process? What kinds of things could they be doing strategically?

• 30:44Speaker 02

  You've got to think about the rights that you're including for that investor. Those rights on board, information rights, absolutely decision rights, may trip you into CFIUS one way or another. So that's critical.

• 30:54Speaker 03

  And that investor might not care about those things.

• 30:56Speaker 02

  That's right. And you might tell that investor, if you get this, it's going to delay things and we have a long process. They may say, oh, God, yeah, it's not worth it to me either. So think about those rights upfront. Second, think about how, in terms of timing, phase your investment in different ways. So maybe they say 9% equity, but, dammit, I want a board seat if I'm giving you 9%. And the answer may be, OK, great, but let's phase the investment. I need the 9% now, I need the equity now, but you'll only get your board seat after we get through this CFIUS process. Three years ago, this is hard because you had lots of foreign investors who weren't thinking about this. Today, you've got a global environment of very, very well-educated foreign investors

• 31:38Speaker 02

  who don't want to run afoul of the rules and are more thoughtful. If you said to certain investors three years ago, "Sorry, if I give you a board seat, we're going to have a CFIUS issue," they'd say, "Well, who cares? Let's go through CFIUS." Today, I think it's actually a very different environment, and they might well say, "Totally understand. I don't need a board seat." So that's good news. They're taking the equity position, but you're delaying some other rights, whether it's a board seat, board observer, and the like. So phase it so it doesn't totally foul up your timeline. Third, you really do have to think strategically about where you're trying to go with the business. Do you want to do work with the US government? Is your priority in Asia or Europe or anywhere else? In which case, you may have to walk through some of this, and you're perfectly fine closing one door to open another.

• 32:23Speaker 02

  So don't just think about this, I know that's hard, when you need equity right away, but you still have to be a little bit strategic looking forward about how this will affect you in the future. Think about if there are ways to structure it so they are LPs and another fund. Now, funds of one aren't good, but to the extent you can work with someone and say, "Listen, we'd love to take your money, but it's problematic if we do it that way. Let's move it over to here," that's really good. Another possibility is, again, early stage, this gets hard, but later stage, you might start looking at not actually selling in the US business. If you've already gone international, carving it up so they're actually making an investment

• 33:05Speaker 02

  outside the United States in some of your growth in other geographic regions. Now, that gets tricky because then you have to really be careful that you're not contributing a US business, that your R&D isn't supporting it, that your people, all those things. But at some point, that becomes quite valuable to create potentially a joint venture overseas with the foreign investor rather than investing in the domestic US company. And if you finally decide, "Well, we've got to do this, but I'm worried about what CFIUS might say," then you're in the world of how are you allocating that risk that CFIUS is going to show up and stop us from doing something or sharing something. So you really have to understand why you're doing the investment. If you're just doing the investment to get the money, the risk isn't that bad for you

• 33:50Speaker 02

  because what would the mitigation be? The mitigation might not be the money. The mitigation might be a lack of information access for the acquirer or the investor. But if what you're trying to do is I want to share information and technology with this foreign investor because they have technology or access to markets that I need, well, then you have to be really careful because that might be exactly what CFIUS cuts off. So you have to understand what the investment thesis is, not just for them, but what it is for you and how CFIUS may affect that. And then you fold into the deal, you got documents, the allocation of risk like you would in any other deal, what the efforts they might have to do for the regulatory regime, when you have a right to walk, things like that.

• 34:28Speaker 03

  What about, we talked about US business doesn't necessarily just mean US business. It could mean just you have a presence in the US. What about where there's no company at all? And here I'm thinking about crypto. We have these things called DAOs, decentralized autonomous organizations or distributed autonomous organizations, and many times they're set up as a nonprofit. Do these rules, the new reforms, speak to that kind of circumstance or not really?

• 34:52Speaker 02

  I think they really don't. I think that is over the horizon for CFIUS. One thing though, going back to the point about judicial review, a lack of judicial review means one really important thing on something like this. CFIUS has enormous discretion to interpret its rules the way it wants to interpret its rules. So it wants to say it's a US business, it wants to find enough indicia of it being a US business, it can say it's a US business. And there's not going to be a court which says, how dare you say that? And there aren't that many investors or companies that want to go fight the US government in court, even if they could, on that sort of thing.

• 35:29Speaker 03

  Well, before we take time for questions, I just wanted to ask you, what do you think are the biggest surprises for which industries or which types of business do you think this is going to, these reforms are really going to affect most in our world?

• 35:43Speaker 02

  I think, I am nervous about anyone who mentions artificial intelligence on their website. Which is everyone. Artificial intelligence, machine learning are inherently challenging places because, ultimately, we're talking about algorithms and where do you actually draw the line between basic mathematical science and research into the application of that? So I think it's going to have a potentially significant impact there. Biotech, anything healthcare-related, is increasingly becoming an area of focus. Certainly, as I've already mentioned, anyone who deals with identifiable information in any way, this is a very hot topic.

• 36:24Speaker 02

  The last two, as I said, if you don't file with CFIUS, CFIUS can always knock on your door and, you know, you can have a really, really uncomfortable period and they can impose penalties or impose divestiture. There are two cases like that right now, both involving Chinese investors and acquirers, both pretty well-known. So I think, I hate to say it, but it's hard to find areas that aren't of concern to CFIUS right now. Again, that doesn't mean that everybody is going to be blocked, it doesn't mean that everyone has mitigation. It does mean, in most cases, thoughtful planning early in the process, structuring in a way where CFIUS is a lesser concern, becomes more and more important.

• 37:07Speaker 03

  And where can people learn more if they want to thoughtfully think about this? I don't want to go file anything, but I want to keep my finger on the pulse of this. What are some resources that people could go look through?

• 37:18Speaker 02

  Yeah, so CFIUS is also a funny regime in that CFIUS never publishes anything publicly. Any other court case, you have a court case and what do lawyers do? They go read the court case. CFIUS doesn't release any of its decisions. It's all confidential, which actually is a good thing for the businesses because you'd rather not have the whole world know what you're doing, how your investors are. So that's a good thing and things tend not to leak out of CFIUS. There's obviously an industry of lawyers who write on this. There are one or two sites. One slight warning, because CFIUS has become a bigger deal, it's sort of like mushrooms after a rainstorm. Experts are popping up everywhere. They're national security experts, they're CFIUS experts.

• 38:00Speaker 02

  If you call someone, if you call firms, say, "Hey, how many CFIUS filings have you done over the past five years?" And if the answer is less than about 100, you ought to be scared. So, find the reputable firms that do this, talk to reputable investors who understand this, and it is something where keeping your finger on the pulse, I just think it's going to be too overwhelming. There's too much change in this environment right now. So, find a lawyer that you trust that you can get on the phone with. It's not always, you know, hundreds of thousands of dollars. Any reputable lawyer should say, "Hey, let's talk through this for half an hour, see if you have a problem." The lawyer understands your technology, who the investor is, what the timeline is, what your business goals are. Say, "Yes, no, or maybe," and then you make a decision about how you want to proceed. And you're not going to get that from just reading something.

• 38:45Speaker 02

  Reading's good background, but again, you're trying to build a business, run a business. You're only going to read so many articles, is my guess.

• 38:52Speaker 03

  Great. Mike, thanks so much for being here. I know people might have questions for you.

• 38:55Speaker 04

  Is there ways you can accidentally back yourself into a CFIUS situation? So, for example, you have downward protection, or secondary market, someone buys your stock, or you go public and someone buys your stock?

• 39:09Speaker 02

  Yeah, so there absolutely are what you described. Everything from convertible debt, which when it converts, and there are rules about how CFIUS treats convertible debt instruments and the like. And CFIUS doesn't matter. It doesn't matter if it's a direct investment in private company, or ownership on the public market. So, you get over 10% public ownership on the public market, and that too implicates CFIUS. It doesn't matter what form of ownership it is, it's just about equity. By the way, debt does not count. Convertible debt gets more complicated, but debt doesn't, so that's another way to structure potentially, which can be helpful.

• 39:52Speaker 02

  Now, if you have debt and you have some other rights on top of that debt, it gets a little bit more complicated. But, yes, you have to be aware of your shareholder base, public, private, regardless of how it comes in. Now... It does matter to CFIUS in terms of how they look at it because if you've been passive about this, you didn't reach an agreement, somebody just comes in and acquires your debt on secondary market. They may be concerned about what the effects of that are, but they absolutely look at the US business and the target a little bit differently since you have obviously not signed up to do something collaboratively with that foreign investor. So it changes the color, but it doesn't change the jurisdiction analysis.

• 40:36Speaker 05

  The owner's responsibility for filing on the company or the investor acquirer for filing?

• 40:42Speaker 02

  Yeah, so the way the fines work, it's joint and several. So they've only imposed one fine in that so far. So we really don't have a lot of data to know.

• 40:53Speaker 03

  Can you just explain, I mean, joint and several?

• 40:54Speaker 02

  Oh, sure, sure. It means both of you are in trouble. Yeah, so you both have a responsibility. The filing is joint. So any CFIUS filing is joint. It isn't joint if there's been an outright acquisition and after the fact because then there's only one party. So if you get acquired and you get your equity and you get your cash and you walk away, listen, you're good depending on what the contract said. But generally, if you're talking about an investment in a US business, both parties go to CFIUS. Both parties can be fined by CFIUS, although each party generally only states it can only be responsible for its own information.

• 41:36Speaker 02

  So you can't be fined for the foreign investor lying about something. But if you then have a mediation agreement, all right, the foreign investor isn't going to get access to my technology and you provide them access or you do something that violates that national security agreement with the US government, then the fine, you are jointly responsible for that fine.

• 41:58Speaker 05

  Is the application viewed differently based off of the timing? For example, let's say you do it post-wire money versus three months after the wire money and is there penalties associated with the timing?

• 42:10Speaker 02

  Great question. If it's a mandatory filing, then you have to file 45 days before signing, before closing.

• 42:17Speaker 05

  And closing, is that defined as when the wire, when the money is transferred?

• 42:21Speaker 02

  Well, probably, but it also depends on how it's defined in the term sheet. I mean, most term sheets, it's going to be sign and close. But again, that means 45 days before the term sheet is completed. You've got to file. Now, if it's voluntary, there's no requirement to file before or after. So you can file at any time. But here's the important but. Unsurprisingly, CFIUS wants you to file before. It's always a harder conversation if they already have the investment, they already have the rights, and you're going and explaining it. So there are situations where we sort of work with CFIUS and the parties close before they've gotten approval

• 43:04Speaker 02

  from CFIUS, but it has to be done very, very carefully in a knowing, open, transparent way, or otherwise CFIUS has the ability to take it out on you.

• 43:14Speaker 03

  Great. Well, we have time for one more question.

• 43:17Speaker 06

  Where do you think this is all going? The footprint of CFIUS has been expanding, arguably beyond national interest and just broader economic interests of companies. And you mentioned the dialogue with the export control regulations where it's not just at the time of an M&A event or an investment, but ongoingly may need a license from the government just to do business with entities located in foreign jurisdictions. 1% of the transaction is pretty onerous for a mandatory filing, and then who knows what the export licenses would be. Where is this all going, and do you see a stopping point?

• 43:57Speaker 02

  So a couple of pieces on that. First, this is about the only bipartisan thing that has happened in Washington in the last three years. So that tells you something, that regardless of what happens in 2020, this isn't going away. And a lot of this started at the end of the Obama administration. Now, you put on top of that, obviously, the U.S.-China trade tensions. That's clearly exacerbated this, and we've seen instances where these issues are all getting thrown into a pretty messy stew. I don't think Huawei is ZTE, is that national security, is it a negotiating tactic on trade deals? So I think some of that, let's assume going forward, calms down a little bit on the broader U.S.-China trade

• 44:41Speaker 02

  front, I think we'll have a little bit more predictability. But I think the basic trajectory of CFIUS, looking broadly at technology, data, critical infrastructure...

• 44:51Speaker 02

  Expanding that definition of critical technology, that's not going away. There are still a lot of things you can do outside of CFIUS. As I said, licensing of technology does go through export control. That will change, but it doesn't go through CFIUS. So we can't do anything to evade CFIUS, but there are still good ways to do business with overseas investors in overseas environment that doesn't put you squarely in the crosshairs. I don't think going forward, this is going to radically change. What is the stopping point? I hope we don't have a global downturn, but right now, we're in a world where it's not that hard to find capital. There's a lot of capital out there.

• 45:35Speaker 02

  As capital markets start to shrink a lot, I think there'll clearly be an incentive on the U.S. front to open those doors a little bit more widely. So I think there are some macro trends that could start to have this ebb, but I think short of that, the trajectory is going to remain relatively constant at this point.

• 45:52Speaker 03

  Well, on that note, thank you so much, Mike. Thanks for coming in this evening.