CFIUS Releases 2023 Annual Report, Highlighting Enforcement Activity

On July 23, 2024, the Committee on Foreign Investment in the United States (“CFIUS” or the “Committee”) released its most recent annual report (the “Report”), covering the Committee’s activities for calendar year 2023.[1] The Report provides the public with information about the number of transactions reviewed by the Committee, outcomes of reviews, and the industries and foreign countries associated with its reviews.

In an accompanying press release, the U.S. Department of the Treasury (“Treasury”), which chairs CFIUS, noted several highlights, including the Committee’s large case load, improvements in its clearance rates and efficiency, and its enforcement activities, particularly its use of civil monetary penalties. Commenting on the Report, Assistant Secretary of the Treasury for Investment Security Paul Rosen said that “2023 was a busy year for CFIUS . . . CFIUS sharpened its review and enforcement toolkit while doubling down on efficiency and due diligence in reviewing and investigation covered transactions.”[2]

Although comprising largely statistical information and not providing details on the specific considerations involved in a given review, the Report offers a number of insights which we explore below.

Despite Lower Case Numbers, CFIUS Remains a Robust Regulatory Program

In 2023, parties filed 233 “notices” and 109 “declarations” with the Committee, compared to 286 notices and 154 declarations in 2022.[3] Although the total number of filings—both short-form “declarations” and long form “notices”—was down year-over-year from 2022, the number of filings the Committee reviews each year has more to do with overall global merger and acquisition activity[4] and less to do with whether the Committee has tempered its recent trend of being an active and engaging national security regulator.

The slight statistical downtick in the Report should not therefore be viewed in a vacuum. For example, CFIUS activity for the last three years as reported in its annual reports (i.e., calendar years 2021–2023), shows the Committee consistently reviewing hundreds of unique transactions a year. Further, as discussed below, when the Committee’s “non-notified” review activities are factored in, it can be said that CFIUS is now screening thousands of transactions per year in one form or another.

CFIUS therefore remains an important regulatory consideration for dealmakers.

The Declaration Program Has Matured into a Real Option, at Least for Lower Risk Investors

A creation of the Foreign Investment Risk Review Modernization Act of 2018 (“FIRRMA”),[5] the declaration program provides transacting parties with a “short-form” filing option that is evaluated on an expedited, 30-day timeline. Filers that chose the declaration option have the chance to obtain a clearance much faster than they would by filing a notice, but declarations also carry the risk of a longer process because CFIUS may conclude its review of a declaration by requesting that the parties file a long-form notice. In other words, if the conclusion of the declaration process is unfavorable, parties may find themselves back to square one in their CFIUS regulatory process.

CFIUS requesting that declaration filers thereafter submit notices is not an infrequent occurrence. As we noted in our 2023 CFIUS, Outbound Investments, and Export Control Year in Review (“2023 Year in Review”), in calendar year 2022, declaration filings resulted in notice requests 32% of the time (a significant increase from 2021’s 19% rate).[6] In 2023, the rate of notice requests has dropped down to 21% (i.e., 20 such requests out of 109 declarations). Averaging calendar years 2021-2023 together, the notice request rate stands at approximately 25%. In other words, over the last three years covered by CFIUS’s annual reports, about 75% of declarations were able to achieve a successful outcome.

Although a decision whether to file a declaration or a notice should only be made after assessing the specifics of the transaction with CFIUS counsel, it is clear that the declaration program has become a viable approach to obtaining CFIUS clearance—and obtaining it quickly—in many cases. This is particularly true for investors originating from countries that are strategic allies of the United States. It is therefore no surprise that Canada, the United Kingdom, and Japan were the largest source of declaration filers, with Australia, France, and South Korea close behind.

Timing and Efficiency Has Improved, but Is Still a Challenge in Many Transactions

Our 2023 Year in Review highlighted the prevalence of lengthy notice reviews, finding that 57% of notices in 2022 extended into the second 45-day “investigation” period (up from 48% in 2021), and that 31% of notices in 2022 were withdrawn (versus 26% in 2021).[7] At least some of the withdrawn notices were subsequently refiled, meaning that, for a number of transactions, the CFIUS process extended well beyond the 90 days typically allotted for a filing.

The Report also touts CFIUS’s improved efficiency in 2023, with the accompanying press release noting that, “CFIUS cleared 66 percent of distinct transactions that did not require mitigation measures in either the 30-day assessment period for a declaration or the initial 45-day review period for a notice, an increase from 58 percent in 2022.” While this is true, a deeper dive into the 2023 numbers shows that lengthy reviews remain a frequent occurrence.

Recognizing that the number of filings does not equate directly to the number of unique transactions, in 2023, CFIUS reviewed 233 notice filings. Of those, 128, or 54%, progressed into the second 45-day investigation period. This represents a slight, 3%, reduction compared to the number of reviews that progressed into the second stage in 2022, but is more than the 47% rate in 2021. Indeed, 2022–2023 represent a reversal of what had been a lengthy trend dating back to 2015 wherein a majority of notices were cleared in the first review period (including pre-FIRRMA years where the first period was only 30 days). Further, the Report states that, in 2023, 57 notices were withdrawn after commencement of investigation. This equates to approximately 25% of all notices, which again represents only a relatively modest improvement over the 31% of withdrawn notices in 2022.

Undoubtedly, CFIUS’s efficiency improved in 2023 compared to the year before. But, a significant number of notice filings continue to result in lengthy review processes. Fewer than half of all notices clear in the first 45-day review period. A substantial percentage of notices, nearly a quarter, must be withdrawn after going through the 90-day process (i.e., the 45-day review followed by a 45-day investigation). Although some of those transactions are abandoned, as discussed below many of them will ultimately be cleared by CFIUS. This means that, in complex transactions, parties should anticipate processes that may extend well beyond 90 days.

Mitigation (and Abandonments) Remain Common

In addition to timing considerations, parties must continue to consider the likelihood that CFIUS will only clear their transaction if it is conditioned on a mitigation agreement, as well as the potential that CFIUS will decide that security risks cannot be mitigated, thus forcing the parties to abandon their transaction outright.

In 2023, CFIUS required mitigation as a condition of its approval in 35 cases, or approximately 21% of all distinct transactions. This is a substantial number consistent with recent trends. Further, the Report notes that in nine cases, parties abandoned their transactions after being informed by CFIUS that the Committee could not identify any acceptable measures to mitigate threats to U.S. national security. In another five cases, parties abandoned transactions for commercial reasons (of which timing could have been a consideration).

A substantial number of transactions could only obtain clearance after the parties agreed to mitigate national security risks that the Committee had identified, and a number of other transactions had to be abandoned by their parties outright. Particularly with CFIUS’s emphasis on enforcement and its increased use of civil monetary penalties, parties must carefully consider the range of potential mitigation outcomes before entering into a transaction. Even in lengthier reviews, parties often have only days or weeks to negotiate the terms of mitigation agreements (and, as we previously discussed[8] CFIUS has proposed changes to its regulations which could further limit the parties’ time to negotiate agreements), so thoughtful preparation for mitigation scenarios is critical to successfully navigating the CFIUS process.

CFIUS Is Following Through on Tougher Enforcement Talk

In recent years CFIUS has publicly emphasized its focus on enforcement, from issuing enforcement and penalty guidelines in 2022 to a number of other public statements, including several by Assistant Secretary Rosen.[9]

CFIUS is now following through on this tougher talk. As the Report notes, in 2023 the Committee assessed four civil monetary penalties for breaches of material provisions in mitigation agreements—double the total number of such penalties issued by CFIUS in its entire 50-year history up to that point. On top of these penalties, the Report touts other aspects of the Committee’s focus on enforcement. CFIUS conducted 43 site visits to assess the parties’ compliance with their mitigation agreements and now routinely requires the parties to mitigation agreements to establish formal compliance plans. As part of its oversight activities, the Committee undertook “several” investigations related to compliance, some of which identified instances of noncompliance which were addressed through measures other than civil monetary penalties.

The Report also indicates that CFIUS continues to aggressively search for non-notified transactions, particularly those that may have been subject to mandatory filing. CFIUS now screens “thousands” of transactions as part of its effort to identify potential non-notified transactions worthy of investigation and, in 2023, opened formal non-notified inquiries for 60 transactions, requesting notice filings for 13 of those. This non-notified effort is robust and, as the Report describes, uses various sources of information, including tips from the public, open-source information, voluntary self-disclosures, classified government information resources and other commercial and proprietary information sources.

Looking forward, it seems that CFIUS will continue to focus on enforcement efforts. Treasury recently proposed new rules that would increase CFIUS’s information collection authority regarding non-notified transactions, as well as its authority to levy penalties.[10] Treasury also proposed a new rule that would vastly expand CFIUS jurisdiction over certain real estate transactions near military installations.[11]

Conclusion

CFIUS’s annual reports continue to provide a useful tool for understanding the increasingly robust operations of a regulatory process that otherwise remains largely shrouded from public view. The Report demonstrates that CFIUS has grown from a relatively unknown, ad hoc body of government security officials to a mature government regulator that not only has the capability to review hundreds of investment and M&A transactions each year, but also the capability, and the capacity, to actively enforce its authorities.

*       *       *

[1]       U.S. Dep’t of Treasury, Committee on Foreign Investment in the United States: Annual Report to Congress (Jul. 23, 2024), available here.

[2]       Id.

[3]       Because parties sometimes withdraw and “refile” their notices, the number of filings does not directly equal the number of unique transactions reviewed by the Committee, but we can assume that the approximately 25% drop in the number of filings this year equates to a roughly similar drop in the number of unique transactions reviewed.

[4]       In 2023, “global M&A activity dropped 16 percent” from 2022.  McKinsey & Co., Top M&A Trends in 2024: Blueprint for Success in the Next Wave of Deals (Feb. 20, 2024), available here.

[5]       See Pub. L. 115–232, div. A, title XVII, § 1701 (Aug. 13, 2018), 132 Stat. 2174.

[6]       See Paul, Weiss, 2023 Year in Review: CFIUS, Outbound Investments, and Export Controls (Dec. 21, 2023), available here.

[7]       Id.

[8]       Last year, Assistant Secretary Rosen announced that in 2023, CFIUS had issued two monetary penalties, the same number that the Committee had previously issued in its entire history, and noted that there were more penalties “pending at various stages.” See 2023 Year in Review at Note 6. After Treasury issued a notice of proposed rulemaking in April 2024 that aimed to substantively update the Committee’s mitigation and enforcement toolkit since Congress passed FIRRMA in 2018, Assistant Secretary Rosen said, “[T]hese updates to our enforcement toolkit provide CFIUS with a sharper scalpel to carefully and methodically address violations and protect U.S. national security. See Paul, Weiss, Treasury Proposes a “Sharper Scalpel” for CFIUS Enforcement (Apr. 12, 2024), available here.

[9]       Id.

[10]     Id.

[11]     Paul, Weiss, Treasury “Vastly Expands” CFIUS Authority Over Real Estate Transactions Near Military Installations (July 11, 2024), available here.