CFIUS Releases First-Ever Enforcement and Penalty Guidelines

On October 20, the Committee on Foreign Investment in the United States (“CFIUS”) released its first-ever enforcement and penalty guidelines (the “Guidelines”). The Guidelines provide important information about the penalties that CFIUS can impose, the penalty process, and the aggravating and mitigating factors it takes into account when imposing penalties.¹ The release of the Guidelines comes just a few weeks after President Biden issued an executive order directing CFIUS to consider specific risk factors in its review of foreign investments in the United States (our analysis of that executive order).

Three Types of Violative Conduct

The Guidelines specify three types of conduct that may constitute violations of the CFIUS laws, regulations, or mitigation requirements—and, therefore, could result in the imposition of penalties:

• A failure to submit a mandatory CFIUS filing when one is required;
• Non-compliance with a CFIUS mitigation agreement, condition, or order; and
• Material misstatements or omissions of information filed with CFIUS or the filing of false or materially incomplete certifications with CFIUS.

Information Gathering

The Guidelines also confirm that CFIUS gathers information about potential violations through a variety of methods, including through information gathered from other government agencies, formal requests for information from parties to transactions (or mitigation agreements), tips from the general public, self-disclosures from those engaged in potentially violative conduct, and formal subpoenas issued by CFIUS.

Aggravating and Mitigating Factors

Importantly, the Guidelines also provide information on the aggravating and mitigating factors that CFIUS considers in deciding whether to assess a penalty and the amount of a penalty to be imposed. The six factors specified in the Guidelines are:

• Accountability and Future Compliance. This factor focuses on the impact of a potential enforcement action on protecting national security and ensuring accountability for the parties involved.
• Harm. Here CFIUS considers the effects (whether actual or threatened) of the violating conduct itself on national security.
• Negligence, Awareness, and Intent. CFIUS considers the intentionality of the conduct, whether the parties conceal or delay sharing information with CFIUS, and the seniority of personnel within a party that knew or should have known about the conduct.
• Persistence and Timing. This factor includes the frequency and duration of the conduct and the elapsed time between a party becoming aware of the conduct and either remediating it, informing CFIUS, or CFIUS otherwise becoming aware of it.
• Response and Remediation. Here CFIUS considers whether a self-disclosure is submitted (and, if so, its timeliness, nature, and scope of information), the cooperation of the parties involved, the promptness of remediation, and the parties’ actions to prevent reoccurrence.
• Sophistication and Record of Compliance. Finally, CFIUS considers a party’s history and familiarity with CFIUS; its previous record of compliance (if applicable); the resources (both internal and external) it dedicates to compliance; the compliance policies and procedures it has in place; the variation of compliance within the party and its demonstrated commitment to compliance (its “compliance culture”); its compliance with other legal obligations; its implementation of compliance procedures related to a mitigation agreement; and the authority, role, access and independence of any security officer that the party has in place.

Penalty Process

Finally, the Guidelines outline the process CFIUS must undertake when imposing a penalty (promulgated at 31 C.F.R. §§ 800.901 and 802.901). First, CFIUS must provide parties with a written notice of penalty, including an explanation of the conduct at issue, the amount of penalty to be imposed, and the aggravating and mitigating risk factors to be considered. Parties then have 15 business days to submit a petition for reconsideration, which can include defenses, justifications, mitigating factors, or explanations. CFIUS must consider timely petitions for reconsideration and, within 15 business days, issue a final penalty determination to the parties involved.

Takeaways

The Guidelines are the latest indication of the seriousness with which CFIUS views its enforcement capabilities, its authority to require mitigation to address national security concerns resulting from foreign investments in the United States, and its desire to put commercial actors on notice of the risks of significant penalties for the identified actions. Parties to transactions that are subject to CFIUS’s jurisdiction should pay close attention to CFIUS’s sharpened enforcement posture.

¹ Section 721 of the Defense Production Act of 1950, as amended (50 U.S.C. § 4565) authorizes CFIUS to impose penalties and other remedies for violations of Section 721, CFIUS regulations, or other mitigation orders, conditions, or agreements entered into by CFIUS.