How To: Navigate CFIUS
Russ Wilcox
Partner at Pillar VC
How to Navigate CFIUS
If you run a United States start-up commercializing science and technology, two changes coming out of Washington D.C. could greatly affect the way you raise money and operate your business.
In August 2018, Democrats and Republicans joined in passing the Foreign Investment Risk Review Modernization Act (FIRRMA). After November 10, 2018, if a foreign party invests in certain US companies, the transaction must be reported in advance and reviewed by a federal committee called the Committee for Foreign Investment in the United States (CFIUS).
The CFIUS review will add between 30 and 105 days of delay, create legal costs of $5K - 200K or more, and block some potential investors.
A related change is coming later this year. The Commerce Department will place U.S. export controls on many “emerging or foundational” technologies, which in turn will broaden the reach of CFIUS.
Some background...
These changes come in response to China’s “Made in China 2025” plan of 2014–2015, as China seeks to shift its economy from commodity manufacturing to advanced technology based on China-controlled intellectual property. Chinese industry giants and PE firms received easy credit to help them buy foreign technology companies. China also increased its basic R&D spending and went shopping in the U.S. where they found an eager reception from start-ups. In 2015, the annual Chinese venture investment in U.S. startups jumped from $200 million to today’s level of $2 billion.
Some Chinese VCs offered high valuations to US founders, provided that the start-up would give a Chinese company technology access and the right to exploit freely in China. Chips, biotech and AI/ML were targeted heavily. There also are concerns about access to US citizen personal information and medical records and about efforts to buy companies with land near U.S. military bases.
Although FIRRMA was inspired by China, the law affects how a start-up does business with foreign persons from any country, including allies like the UK.
At Pillar, we frequently back start-ups developing advanced technology. Ask yourself two main questions about your start-up, starting with export control since that affects whether CFIUS is relevant to you.
DISCLAIMER: The summary and suggestions in this post are for discussion only — I am a layman and this is not legal advice; consult your own attorney. All opinions are personal and do not reflect an official view of Pillar Companies.
Although FIRRMA was inspired by China, the law affects how a startup does business with foreign persons from any country.
For now you have to guess. The definition of “emerging and foundational” has not yet been finalized by the Commerce Department. A few months ago Commerce invited comment on a list of general fields (see here — click, read and come back) such as AI, autonomous transport, biotechnology, neurotechnology, robotics, cryptography, quantum computing, and nanotechnology. If the list were to stay this broad, it could affect a healthy fraction of the VC-backed companies in America. We will know later in 2019.
Under export control, your life will change a lot. The reason for this is how Commerce defines foreign person and export.
"Foreign Person"
"Export"
At my second start-up Transatomic Power, a developer of next-generation nuclear power technology, we lived under export controls. You will want to:
- Secure physical technical information. Preventing physical access extends to foreign visitors, foreign employees, and even the janitorial staff. You need locked offices and filing cabinets, a high-grade shredder, blinds on windows, and required visitor check-in at the entrance.
- Secure digital information. The standard as to how paranoid and aggressive you need to be on cybersecurity is murky: I’m told that you are not really expected to be able to withstand a determined campaign by a foreign state, however you do need to take all prudent actions necessary to withstand industrial espionage and hackers. Secure servers in locked cages, install high-end firewalls, pay third party consultants to audit and monitor, air-gap the most sensitive work, and secure mobile devices.
- Identify the jobs that have access to your confidential technical information, and change those job descriptions to require US citizens. For existing foreign employees, even current Green card holders, you will need to reassign them until you receive an export license from Commerce.
- Update your Non-Disclosure Agreement (NDA) so that US recipients acknowledge that the information you intend to share will require their compliance with US export control laws. Make sure your confidential technical documents are all labeled “Subject to US Export Control.” Bear in mind you can no longer sign NDAs with foreign companies until after you receive a license from the Commerce Department.
- Do not share technical information with your accountant, lawyer, or investor. Few have export control capabilities and training in place.
As you can see, a startup living under export control faces significant costs. Raise perhaps an extra $500K-$1 million at seed for this. Do not assume that the people who make the rules have any sense of humor or share your desire to support innovation in these fields. If you think you could be affected, seek out an attorney in Washington DC who practices export control law, get informed, and train your staff. The good news is that the Commerce Department does often grant export licenses. Another saving grace is that any technical information you are willing to publish openly is no longer covered (e.g. 18 months after you file a patent). This is how academics can teach and research openly in these sensitive fields.
As you can see, a startup living under export control faces significant costs. Raise perhaps an extra $500K - $1M at seed for this.
Must your next funding be pre-approved by CFIUS?
The answer is yes if ALL four of these tests are true:
- Do you develop critical technology? Critical technology is anything military-useful, nuclear, toxic, or export-controlled. That used to be narrow, but when the export-controlled list expands later this year it will include some or all emerging technologies listed by Commerce above.
- Is the critical technology sold into an industry relating to US national security? The initial “Pilot Program” list is: aircrafts, engines, aluminum, ball bearings, computers, missiles, tanks, cameras and lenses, some inorganic chemicals, petrochemicals, powder metallurgy, transformers, batteries, wireless equipment, nanotechnology R&D, biotechnology R&D, instruments for navigation, semiconductors, and turbines.
- Are any of the investors foreign persons? That includes foreign funds, foreign partners at US funds, and even US funds with US partners if they rely significantly on foreign sources of money.
- Does the foreign investor receive control? — control is a term that makes more sense if you read it as “influence” by even one of the following: access to Board meetings (even an Observer seat), access to material non-public technical information, technology transfer rights, >10% voting block, or other vetoes or rights to affect company decisions.
In addition, CFIUS is interested in companies that store personal data (PII) of US citizens and companies with real estate in sensitive locations.
If you answered yes to all four, you can:
- Drop the foreign investors. Cash is cash and there are a lot of US sources. You may not have this option though if one of your existing foreign investors insists on exercising pro rata rights in a future round.
- File a short disclosure to CFIUS. If you think your investors are non-threatening to the United States, the filing is just a 5-page form and it probably costs you $5-10K of legal work and takes 2 weeks. You list all foreign investors in the same filing. Within 30 days CFIUS will approve or ask you to file a long form.
- File a long form for CFIUS. Go straight to this step if you already know your tech is sensitive, or given the current political environment, start here if any of your investors are from China. After 45 days, CFIUS approves all or some of your investors, or they may ask for more information and extend another 45 days, and if needed another 15 days. I estimate your legal costs here will fall in the range of $30K to $200K with complexity. CFIUS also has the right under FIRRMA to charge a fee of up to 1% of the transaction capped at $300K.
- Restructure the deal to eliminate investor influence. We see three creative ways to close foreign investments prior to a CFIUS approval:
- Put a toggle feature into the Voting Agreement. If the investor is a US entity or a foreign investor who becomes CFIUS-approved in 105 days, then the shares vote normally. Until then, the shareholder must waive all Board and control rights and proxy all votes to the Board. We think this allows a transaction to close quickly and give the company time to pursue CFIUS rights (ideally at that investor’s expense). If the foreign investor does not receive approval, they are protected because they can either continue as a silent partner, or re-sell their shares to a US investor for full value since the shares would regain their full rights.
- Create dual voting and non-voting classes of stock. The foreign investor can buy up to 9.9% of the normal voting stock. Then they can buy more of the second class. I read Softbank is using this method. It seems a bit more complicated than the toggle, but they can afford it.
- Conduct the transaction in two steps. First the foreign investor buys 9.9% at the closing without any voting or Board rights, then a CFIUS review is conducted, and then if approved they buy another 9.9% that votes (twice?) and carries Board rights. I am not enthusiastic about this since the start-up has to bear uncertainty about the size of the closing.
In addition to affecting your investor syndicate, these rules may change your business development plans. It is common for large companies to link equity investments to strategic alliances with start-ups. Now you need to refuse the equity component or slow the deal for CFIUS approval. Another approach we imagine could be worked out is warrants only exercisable at IPO or M&A.
If you are supposed to notify CFIUS and fail to do so, then CFIUS can fine the company for the entire amount of the foreign investment plus penalties, and there is no statute of limitations. This will be a seriously off-putting legal exposure for any future investor or buyer. Therefore, if you are unsure, file.
If your company is ever hit by a CFIUS penalty, the damages may lead to lawsuits between the company and investors or among investors. Do not assume you know which investors are foreign persons. All your financing documents need to have the reps and warranty sections updated, so that investors declare if they are foreign or foreign-influenced and you can represent to investors that you are compliant with all relevant laws. The National Venture Capital Association (NVCA) is working on new standard forms to include this language, and their Term Sheet is updated (see page 7).
The four tests are as of the transaction date. If a company closes an investment that did not require CFIUS, but later adds an emerging technology, it does not have to file with CFIUS until its next funding round involving foreign persons.
It seems like a new CFIUS review would be required if a US investor sells secondary shares to a foreign investor, and if so that also could require an update to boilerplate financing documents.
Implications
The big picture here is that at least some emerging tech start-ups just became harder to operate and fund.
They may increasingly (1) seek to sell initially to US customers first, which will make them less adept at developing products for sale abroad, and (2) partner initially with US corporate giants rather than foreign corporations; and (3) preferentially or exclusively hire American workers in the early days.
As a Boston VC, seeing foreign talent playing key roles at many emerging technology companies, I am very worried this will make it harder for the United States to retain the brilliant minds who are studying in our local universities. This legislation may partially backfire on the United States if the end result is that these students instead move abroad.
Moving forward
The way the export control list is expanded by Commerce will be the key to whether this becomes a burden on many or just a few start-ups. In my view, CFIUS is not the greatest burden here. The US has a big economy and plenty of investors available to back the best startups. The specter of having to pay for security and check with Washington DC for every new NDA, sales order, and non-US hire is the bigger headache by far.
I support the spirit of what the USA is trying to do here, which is to defend itself against calculated attempts to steal IP and undermine the future competitiveness of the US economy. What would be regrettable is if the emerging technology list turns out overly broad, as that will create a tidal wave of administrative work and a logjam of chaos in 2019. CFIUS and Department of Commerce should ideally trim and streamline either the list or these procedures in a practical way so that they do not drastically reduce the ability of entrepreneurs to attract legitimate foreign direct investment, recruit world-class talent, form global alliances, and sell into foreign markets. I am glad the NVCA is providing input to Commerce to help avoid this.
Moving forward
We hope to learn from others who are engaged with emerging technology start-ups coping with these requirements. Please do not hesitate to share your additions and suggestions with me at russ@pillar.vc and let’s crowdsource the best practices.
ACKNOWLEDGEMENTS: This post draws heavily on briefings held in Boston in the past few months by Wilson Sonsini (see their longer version of the 4 tests), Foley Hoag, and Goodwin. All mistakes are my own. Image courtesy of Max Pixel.
