On October 20, the Committee on Foreign Investment in the United States (CFIUS) released new, non-binding Enforcement and Penalty Guidelines (Guidelines). The Guidelines follow upon last month’s Executive Order linking CFIUS reviews directly to the president’s national security prerogatives. In particular, the Guidelines detail the following:

• Categories of conduct that constitute violations.
• Sources of information CFIUS relies upon to determine whether a violation has occurred.
• The process for developing and imposing penalties.
• Aggravating and mitigating factors that CFIUS evaluates when deciding whether to impose a penalty.

Conduct That May Constitute a Violation

The Guidelines identify three categories of conduct that constitute a violation: failure to file a timely mandatory declaration or notice; non-compliance with CFIUS mitigation requirements; and a material misstatement, omission, or false certification to CFIUS. Activity that falls within one of these categories does not automatically qualify as a violation. However, CFIUS has discretion to determine when a penalty should be assessed based on specific aggravating and mitigating factors discussed below.

Sources of Information CFIUS Will Review

The Guidelines list types of information CFIUS may consider when determining whether a violation has occurred. In addition to trawling publicly available information, CFIUS may review information from other government sources, third-party service providers, anonymous informants, and other transaction or filing parties. CFIUS can also request information from relevant parties.

Aggravating and Mitigating Factors

CFIUS weighs aggravating and mitigating factors in “a fact-based analysis” to determine a penalty amount in any particular case. As stated in the Guidelines, CFIUS may consider aggravating and mitigating factors such as the following:

• Importance of accountability and future compliance.
• Extent of harm done to national security.
• Degree of negligence, awareness and intent.
• Frequency of conduct.
• Length of elapsed time between violation and CFIUS’ awareness.
• Presence of a self-disclosure.
• Extent of cooperation and remediation.
• Record of compliance.
• Company’s compliance culture.

The Guidelines also make clear that CFIUS wants voluntary disclosures of potential violations. Disclosures should be timely to receive the most mitigation “credit.” The Guidelines provide that a disclosure should “take the form of a written notification describing all of the conduct that may constitute a [violation] and all of the persons involved.” The Guidelines also suggest that parties may make an initial disclosure before conducting a full investigation and providing a more detailed final disclosure. This is common practice with disclosures in matters involving economic sanctions, export controls, and/or the Foreign Corrupt Practices Act (FCPA), and is a good practice to ensure that voluntary disclosure mitigation credit is indeed earned.

The Penalty Process

The Guidelines outline key steps of the penalty process. CFIUS first sends a penalty notice, which includes an explanation of the relevant conduct and the monetary amount of the penalty to be imposed. That notice will consist of the legal basis for the penalty and any aggravating or mitigating factors that support the penalty determination.

The party at issue has 15 business days to submit a petition for reconsideration. CFIUS will consider any such petition and issue a final penalty within 15 days of receipt of a petition. If no petition is made, CFIUS will issue final notice of the penalty.

Note that CFIUS intends to publish information on its website about specific enforcement actions. In time this enforcement information could prove an added source of guidance on how and when CFIUS imposes penalties.

Going Forward

The issuance of the Guidelines is indicative of an increasingly proactive and assertive CFIUS. While 2021 was historically busy for CFIUS, given the expansion of CFIUS jurisdiction over the past several years, it is likely that activities will increase even more in the future. Any party involved or potentially involved in an investment with CFIUS implications needs to recognize the importance of complying with CFIUS requirements and the increased likelihood of penalties for failing to comply.