Treasury finalizes rule expanding CFIUS monitoring and enforcement authority

On November 18, 2024, the Treasury Department issued a final rule (Final Rule) that will sharpen the investigative and enforcement authorities of the Committee on Foreign Investment in the United States (CFIUS or the Committee).[1] The Final Rule:

• Expands the information CFIUS may require transaction parties and other persons (e.g., banks, underwriters and services providers) to submit in investigations;
• Expands the circumstances in which CFIUS may impose a civil monetary penalty (CMP) for material misstatements or omissions to include statements required outside the context of a filing;
• Increases the base CMP that may be imposed for violations of the CFIUS regulations from $250,000 to $5 million;
• Adds the original value and current value of the U.S. business as alternative tests for the maximum CMP for violation of a mitigation agreement or order; and
• Gives the CFIUS Staff Chairperson discretion to set deadlines as short as 3 business days to respond to mitigation proposals during reviews.

The Final Rule is generally consistent with the proposed rule (the Proposed Rule), which we covered in our previous client update. The most notable revision in the Final Rule is that the deadline for responding to CFIUS mitigation proposals during a review will be discretionary, but no shorter than three business days, rather than three business days by default. CFIUS declined to impose any deadline for proposals or responses upon itself.

As we have previously noted, CFIUS under the Biden administration heavily emphasized the investigation of non-notified transactions and enforcement of mitigation agreements, increasing staff, imposing penalties, steadily increasing its review of non-notified transactions, and consistently emphasizing enforcement in public statements.[2] While the Trump administration’s attitude toward CFIUS enforcement remains to be seen, based on the first Trump administration we would not expect any lessening of CFIUS’s emphasis on enforcement, and its new powers are likely here to stay.

The Final Rule will become effective on December 26, 2024.

What does the Final Rule do?

Requests for information and subpoenas

The Final Rule expands CFIUS’s ability to require the production of information, including from third parties. Under the Final Rule, CFIUS may require parties to a notified transaction, or the parties to a non-notified transaction or any third party, to provide information as needed to determine whether (1) a transaction is a covered transaction, (2) a transaction “may raise national security considerations,” and (3) a transaction triggers mandatory filing requirements (which apply to certain transactions involving a U.S. business involved in critical technologies, critical infrastructure or sensitive personal data). The Final Rule also provides CFIUS with authority to require parties to any mitigation agreement to provide information to CFIUS as required to assess and monitor compliance with or enforce the terms of a mitigation agreement (or order). Finally, any person that has submitted information to the Committee will be required to respond to requests for information from CFIUS to allow the Committee to determine whether the person made a material misstatement or omitted material information during the course of a previously concluded review or investigation (including a review or investigation that ended with rejection of the parties’ notice). These requirements are mandatory and can be enforced by subpoena as required.

The Final Rule also confirms that CFIUS will treat information submitted by third parties in accordance with its confidentiality obligations. Among other things, this means submitted information would be exempt from disclosure under the Freedom of Information Act, but it could still be shared with other federal agencies or Congress in accordance with CFIUS’s usual procedures (which typically include disclosure safeguards).

Increased maximum penalties

The Final Rule adopts the proposed increases to the maximum civil monetary penalties for violations of the CFIUS statute (50 U.S.C. § 4565), CFIUS regulations or the terms of a mitigation agreement. Under the Final Rule, the penalties are increased and expanded as follows:

• Material misstatements and omissions in response to information requests. The Final Rule expands civil penalties for material misstatements and omissions from those made in connection with filings and certifications to those made in response to mandatory CFIUS information requests, if the request specifies that the request is subject to the penalty provisions.
• Increased CMP for material misstatements and omissions. The maximum CMP for a material misstatement or omission, or false certification, increases from $250,000 to $5 million for each violation that occurs on or after the effective date of the Final Rule (even if the underlying transaction was consummated prior to the effective date).
• Increased CMP for a failure to submit a mandatory declaration. The CMP for a failure to submit a mandatory declaration is the greater of $5 million (also increased from $250,0000) or the value of the transaction.
• Increased CMP for material mitigation agreement violations. The maximum CMP for violating a mitigation agreement, whether intentionally or through gross negligence, is the greatest of any of the following: (1) $5 million per violation; (2) the value of the transaction notified to CFIUS; (3) the value of the violator’s interest in the US business at the time of the transaction; and (4) the value of the violator’s interest in the U.S. business at the time of the violation.
• Expanded penalty petition timeline. Under the Final Rule, parties will have up to 20 days to submit a petition to CFIUS in response to a penalty notice and the Committee will have 20 days to respond.

While the maximum CMP amounts are increased under the Final Rule, penalty assessments will remain consistent with current practices, meaning the maximum penalty serves as an upper limit and not as a default. In addition, penalty assessments will still be based on the nature of the violation and aggravating and mitigating factors with regard to conduct.[3] Finally, the new maximum CMPs are not retroactively applicable to existing mitigation agreements.

Timelines for responding to mitigation proposals

Under the previous CFIUS regulations, parties to a Joint Voluntary Notice are required to respond to follow-up information requests within three business days during the course of a review; however, the regulations did not prescribe a time frame within which parties are required to respond to mitigation proposals. The Proposed Rule included a default three-business-day deadline for parties to submit a “substantive response”[4] to the Committee’s proposed mitigating terms. In response to negative comments, CFIUS revised the Final Rule to empower the CFIUS Staff Chairperson to set a discretionary deadline of no fewer than three business days to respond.

The Final Rule provides a number of factors to guide the Staff Chairperson in setting a deadline:

1. The statutory deadline for completing an investigation under Section 721 of the Defense Production Act, the statutory authority for CFIUS, (i.e., the45-day investigation period, which follows the initial 45-day review period);
2. The risk to the national security of the United States arising from the transaction;
3. The party’s or parties’ responsiveness to the Committee;
4. The nature of the transaction;
5. The appropriateness of suspending, or imposing conditions on, the transaction; and
6. Other such factors the CFIUS Staff Chairperson may determine to be appropriate in connection with a specific transaction.

CFIUS declined to impose any corresponding timetable for its own proposals or responses, citing the need for internal coordination (and ignoring the fact that transaction parties also often have competing perspectives and interests). The potential penalty for failure to respond to proposed mitigation terms in the time frame specified by the Committee, however, is only rejection of the notice by CFIUS (an action which is itself discretionary). In such case the parties would need to refile the notice and begin the process again. As a practical matter, this may not have much of an impact on transaction timing if the parties and CFIUS have been unable to agree on mutually acceptable mitigation, though it is likely to impose at least some delay.