US Treasury Department issues final regulations to “sharpen and enhance” CFIUS penalty and enforcement authorities

The US Treasury Department has issued a final rule (the Final Rule) revising current regulations to “enhance certain CFIUS procedures and sharpen its penalty and enforcement authorities.” The Final Rule follows an earlier Notice of Proposed Rulemaking (the Proposed Rule), on which we previously reported. As summarized in the Treasury Department’s accompanying press release, the Final Rule is the “first substantive update” to CFIUS regulations addressing enforcement, civil penalties, and monitoring since the 2018 reforms instituted by the Foreign Investment Risk Review Modernization Act.

The Final Rule, which takes effect December 26, 2024, largely tracks the Proposed Rule, and amends the current regulations to:

• Expand the categories of information that CFIUS may request from transaction parties, as well as from third parties. Under the new regulations, CFIUS can request the parties to a transaction, and now expressly, third parties, to provide CFIUS with information to assess not just whether the transaction is a covered transaction (i.e., is subject to CFIUS jurisdiction), but also to determine whether the transaction may raise national security concerns, and as appropriate whether a non-filed transaction meets the criteria for a mandatory CFIUS filing (and therefore, should have been submitted for CFIUS review).
• Expand when CFIUS may use its subpoena authority. Giving teeth to the expanded categories noted above, the new rules, per the Treasury Department, will empower CFIUS to “compel through issuance of a subpoena the production of information not only from transaction parties but also from other persons to aid in the enforcement or administration of the CFIUS statute and regulations.”
• Enable CFIUS to introduce a time frame, determined case-by-case, within which parties would be required to respond to a CFIUS proposal to address an identified national security risk. CFIUS is looking to address instances, particularly with non-notified transactions, where deal parties have appeared “less motivated” to respond promptly when negotiating mitigation agreements (undertakings). But, in a departure from the Proposed Rule, the Final Rule jettisons the three business day deadline initially proposed for responding to mitigation proposals, with the Treasury Department explaining that this change was made following consideration of public comments noting the challenges “in negotiating effective mitigation terms that a U.S. business can operationalize within a three-day, broadly applicable time frame.”
• Expand the circumstances in which a civil monetary penalty may be imposed and increase the maximum civil monetary penalty available to CFIUS. Under the Final Rule: (i) a maximum penalty of $5 million (increased from $250,000) can be imposed per violation for a material misstatement, omission or a false certification to CFIUS; (ii) a material violation of a mitigation agreement entered into on or after December 26, 2024 can result in a civil penalty which is the greater of $5 million (up from $250,000), the value of the person’s interest in the US business (or its parent, as applicable) at the time of the transaction or at the time of the violation, or the overall transaction value; and (iii) a maximum penalty of $5 million (from $250,000) or total transaction value (whichever is greater) can be imposed for failing to file a transaction subject to CFIUS mandatory filing requirements.
• Extend a party’s deadline to contest a CFIUS imposed penalty. Under the Final Rule, a party receiving notice of a CFIUS penalty now has up to 20 business days (increased from 15 business days) following receipt to request relief or reconsideration of that penalty and offer a defense, justification, or explanation for the underlying conduct. CFIUS, in turn, has 20 business days (up from 15 business days) from receipt of the petition to issue any final penalty determination.