The Committee on Foreign Investment in the United States (CFIUS) recently announced a Final Rule (the November 26 Final Rule) — appearing in today's Federal Register — expanding its authority under its regulations (31 C.F.R. Parts 800-802) to gather information, issue subpoenas, impose civil penalties, and compel transaction parties to engage with CFIUS on mitigation measures in a timely manner. Earlier this month, CFIUS issued another Final Rule making various updates to the real estate portion of its regulations (the Military Installation Final Rule). Taken together, these new regulations are not a sea-change in the types of transactions subject to CFIUS jurisdiction, but they increase the stakes for transaction parties and signal that CFIUS is not hesitant to reassess the tools at its disposal for fulfilling its national security mission. 

The New Rules

The November 26 Final Rule finalizes, with limited revisions, changes CFIUS proposed in April of this year (April Proposed Rule), which we discussed here. The Military Installation Final Rule finalizes a separate proposal from July 2024. The two rules modify CFIUS procedures and authority in four key ways.

1. Authority to Gather Information: The new regulations expand the categories of information CFIUS may require parties to provide and the situations in which it may request that information, with a particular focus on transactions that were not submitted to CFIUS for review (non-notified transactions). The regulations confirm CFIUS can even require non-parties, like underwriters, to provide information in scenarios such as determining whether a non-notified transaction is subject to CFIUS's jurisdiction. The revisions also expand CFIUS's subpoena power. 
2. Timelines for Negotiating Mitigation: The April Proposed Rule included a three-day timeline for transaction parties to respond to mitigation proposals. The November 26 Final Rule relaxes this timeline in response to comments voicing concerns that such a short, uniform deadline would be infeasible in many situations. Instead, the November 26 Final Rule provides that CFIUS may, on a discretionary basis, set a deadline that is no shorter than three business days. Deadline decisions will be based on a non-exhaustive list of factors including the risk to national security arising from the transaction, the time remaining until the statutory deadline for investigating the transaction, and the responsiveness of the parties. 
3. Penalty Maximums and Procedures: The November 26 Final Rule increases the maximum civil penalty for material misstatements or omissions and false certifications from $250,000 to $5,000,000, as proposed in April. CFIUS also has a broader penalty menu to choose from for violations of a mitigation agreement, including the same $5,000,000 per-violation maximum and variations based on ownership interests and transaction values (penalties for failure to file a mandatory declaration remain unchanged: the greater of up to $250,000 or the value of the transaction). The rule also extends the time in which a party may petition for penalty reconsideration from 15 to 20 days.
4. Expanded Real Estate Jurisdiction: CFIUS has jurisdiction over certain real estate transactions involving foreign persons where the real estate is within or functions as part of certain ports, or is within a specified distance of a military installation listed in Appendix A to 31 C.F.R. Part 802. The Military Installation Final Rule updates Appendix A to include 59 new locations (from radar sites in Alaska to a naval facility in Puerto Rico). These sites were identified by the U.S. Department of Defense (DoD) during a recent, comprehensive national security evaluation of military installations. The rule also changes the relevant geographic distances for several installations, conforms official names and locations for certain installations, and modifies the definition of "military installation." 

The Military Installation Final Rule is effective December 9, 2024, while the November 26 Final Rule is effective December 26, 2024. For the latter, transactions currently under review as of the December 26 effective date and pending penalty notices will not be subject to the new timelines and mitigation agreements already in place will not be subject to the new penalty maximums. However, the November 26 Final Rule emphasizes that conduct not governed by an existing mitigation agreement, including material misstatements to CFIUS, will be subject to the regulations as amended, regardless of whether the party is subject to an agreement governed by the prior regulations.

Key Takeaways

• Plan for Increased and More Aggressive CFIUS Enforcement: The final rules are the latest in a series of reminders that CFIUS views all aspects of its authority through the lens of national security and reacts accordingly. This applies at every stage in a transaction process, from assessing whether a prospective transaction is within its jurisdiction to enforcing a mitigation agreement. That said, not all violations lead to a monetary penalty and CFIUS may assess monetary penalties of far less than $5 million in the future. Penalty assessments are based on the nature of the violation, as well as any aggravating and mitigating factors. At this point, there is no indication that the upcoming change in administration will dampen CFIUS's focus on enforcement.
• Analyze Potential Transactions Early and Carefully: The new rules increase the risks for transaction parties in a number of ways beyond potentially higher monetary penalties. For example, when CFIUS learns of a non-notified transaction, the changes confirm its willingness to turn to a wide range of parties to inquire about the transaction. This may lead lenders and other financial institutions to increase their own CFIUS-related due diligence and impact their risk tolerance in other ways.
• Plan for Mitigation Negotiations: While only a percentage of transactions require mitigation and CFIUS may provide more than three days for parties to consider its proposals, parties should nevertheless be prepared to respond within tight timelines. Early in the deal negotiation process, parties should analyze the feasibility of implementing common mitigation provisions. In particular, they should understand the practical barriers — such as procedures required under a company's current bylaws or the limitations of existing IT systems — that may impact the parties' ability to agree to mitigation terms or increase the fund outlay needed to implement that mitigation. 

For more information, please contact:

Timothy P. O'Toole, totoole@milchev.com, 202-626-5552

Laura Deegan, ldeegan@milchev.com, 202-626-5942

Caroline J. Watson, cwatson@milchev.com, 202-626-6083

Melissa Burgess, mburgess@milchev.com, 202-626-5914

Manuel Levitt, mlevitt@milchev.com, 202-626-5921

Rebecca Tweedie, rtweedie@milchev.com, 202-626-1487

The information contained in this communication is not intended as legal advice or as an opinion on specific facts. This information is not intended to create, and receipt of it does not constitute, a lawyer-client relationship. For more information, please contact one of the senders or your existing Miller & Chevalier lawyer contact. The invitation to contact the firm and its lawyers is not to be construed as a solicitation for legal work. Any new lawyer-client relationship will be confirmed in writing.

This, and related communications, are protected by copyright laws and treaties. You may make a single copy for personal use. You may make copies for others, but not for commercial purposes. If you give a copy to anyone else, it must be in its original, unmodified form, and must include all attributions of authorship, copyright notices, and republication notices. Except as described above, it is unlawful to copy, republish, redistribute, and/or alter this presentation without prior written consent of the copyright holder.