The Department of Defense (DoD) recently issued interim final regulations governing the assessment of foreign ownership, control or influence (FOCI) in connection with applications for facility clearances by companies seeking access to classified information. The rulemaking adds a new Subpart C to Title 32 of the Code of Federal Regulations (32 C.F.R. Part 117). The regulations are effective as of April 9, 2014. However, DoD is accepting comments on the new rules through June 9, 2014.
These regulations change several important aspects of the FOCI analysis and mitigation process. For example, if a foreign entity proposes to acquire a classified contractor and the Defense Security Service (DSS) has not completed its FOCI analysis prior to the acquisition, DSS may invalidate the contractor’s existing facility clearance. Under prior practice, contractors maintained their clearances following an acquisition or merger while negotiating an acceptable plan with DSS.
The following summarizes those aspects of the new regulations most significant to corporate combinations and financings: (i) DSS’s procedures for determining whether or not FOCI is present, (ii) DSS’s methods for mitigating or negating FOCI; and (iii) DSS’s role in the Committee on Foreign Investment in the United States (CFIUS) process.
How and When DSS Determines Whether FOCI is Present
The basic definition of FOCI contained in the new regulations is consistent with that already set forth in the National Industrial Security Program Operating Manual (NISPOM):
A U.S. company is considered to be under FOCI whenever a foreign interest has the power, direct or indirect (whether or not exercised, and whether or not exercisable through the ownership of the U.S. company’s securities, by contractual arrangement, or other means), to direct or decide matters affecting the management or operations of the company in a manner that may result in unauthorized access to classified information or may adversely affect the performance of classified contracts.
32 C.F.R. 117.56(b). As is presently the case, DSS will utilize the information provided by a company on the “Standard Form 328,” which is titled “Certificate Pertaining to Foreign Interests” in making its FOCI determination. The regulations do not include changes to the Standard Form 328 questions.
Although the new rules do not materially change the criteria against which FOCI will be judged, they do significantly alter the impact of the FOCI determination process on corporate transactions. They also assign government contracting agencies (GCAs) a significant role in the FOCI analysis. With respect to business combinations, the regulations now provide:
When a merger, sale, or acquisition involving a foreign interest and a contractor is finalized prior to having an acceptable FOCI mitigation or negation agreement in place, DSS will invalidate any existing FCL until such time as DSS determines that the contract has submitted an acceptable FOCI action plan (see DoD 5220-22-M) and has agreed to interim measures that address FOCI concerns pending formal execution of a FOCI mitigation or negation agreement.
32 C.F.R. 117.56(b)(2)(iv)[emphasis added].
Thus, if a transaction closes before the company has finalized a FOCI mitigation or negation agreement acceptable to DSS, the agency will invalidate the company’s facility clearance. In contrast, the NISPOM had permitted contractors to retain their clearances while negotiations with DSS over FOCI action measures were taking place. See NISPOM 2-300.c (“When a contractor determined to be under FOCI is negotiating an acceptable FOCI mitigation/negation measure, an existing FCL shall continue so long as there is no indication that classified information is at risk of compromise”). Under the prior NISPOM language, a common practice was to notify DSS of a pending transaction, close the transaction, and then submit a FOCI mitigation plan to DSS for approval. During the approval period, the existing clearance remained active. Now, in order for the facility clearance to remain active, the acquired and acquiring companies will need to obtain DSS’s approval for any FOCI measures prior to deal closing or risk termination of the facility clearance. Both internal and external discussions concerning the existence and scope of FOCI, and the consequent mitigation measures, will therefore need to occur much earlier in the transaction process. This timing change may in turn have an impact on the point in the transaction at which corporate structure and debt and equity interest percentages must be established.
A second major change initiated by the new FOCI regulations is the grant of approval authority to GCAs. DSS will now submit its FOCI assessment file to the GCAs with an interest in the company or “corporate family,” and provide the GCAs with 30 calendar days to object to DSS’s FOCI determination unless another regulatory review process has an earlier suspense date. 32 C.F.R. 117.56(b)(4)(iv). For contractors performing classified work for multiple agencies, it is possible that each of the relevant agencies will need to review the FOCI package. The effect of this new provision is that, unless there is a faster regulatory timetable, the soonest DSS will be able to turn around a FOCI determination request will be 30 calendar days after it provides notice to the affected GCAs. This is another schedule change that companies holding clearances must factor into planning for corporate combinations.
These two provisions will have a substantial impact on acquisitions, mergers, and financings by foreign entities of government contractors holding clearances. Engagement with DSS will need to begin early in the transaction process in order to ensure that DSS has completed its FOCI analysis prior to closing of the transaction.
FOCI Mitigation and Negation Measures
The new regulations do not significantly alter the existing FOCI mitigation and negation measures. As before, the complexity of the FOCI action plan increases with the extent of the foreign entity’s involvement in and control of the company seeking a clearance. The following summarizes the standard FOCI mitigation and negation measures contained in the regulations:
- No foreign ownership: When there is a foreign interest that does not involve ownership, such as foreign lenders or foreign income, FOCI mitigation measures include actions such as (i) board resolutions excluding the foreign interest from access to classified information and the ability to affect performance on classified contracts, (ii) modifications to loan documents, or (iii) demonstration of economic viability independent of foreign interests. 32 C.F.R. 117.56(b)(4)(ii).
- Foreign ownership:
- If a foreign entity has an ownership interest, but does not own voting interests sufficient to appoint or elect a board member, DSS may approve an exclusionary board resolution to mitigate FOCI concerns. 32 C.F.R. 117.56(b)(4)(iii)(A).
- If a foreign entity is entitled to representation on the company’s governing board, but does not effectively own or control the company, then the company may enter into a Security Control Agreement (SCA). Among other things, an SCA may call for establishment of a special Government Security Committee of the corporate board, a Technology Control Plan, an Electronic Communications Plan, and a prescribed number of outside directors. 32 C.F.R. 117.56(b)(4)(iii)(B).
- In cases in which the foreign entity does effectively control the company and the entity has the right to be represented on the board, DSS may require a Special Security Agreement (SSA). In addition to calling for plans and processes similar to the SCA, approval of an SSA may involve a National Interest Determination (NID), which is to be made by the GCA. 2 C.F.R. 117(b)(4)(iii)(C).
- In other cases involving foreign entity ownership and control and board seats, DSS may require the foreign owner to execute either a voting trust or a proxy agreement, which will place his or her voting interest in the hands of an outside U.S. citizen approved by DSS. 32 C.F.R. 117(b)(4)(iii)(D).
These mitigation and negation actions follow those already described in the NISPOM. However, the impact of the new regulations is to require companies to have proposed one of the actions to DSS, had it approved, and taken steps to implement it, prior to closing corporate merger or acquisition.
The CFIUS Process
CFIUS is an interagency committee charged with the review of proposed transactions that could result in a foreign person or entity controlling a U.S. business and therefore affect national security. DoD is a member of the CFIUS committee, but the DSS FOCI review is an entirely separate process. However, under the new regulations, DSS can request that additional time be added to the CFIUS review process in order for it to complete its FOCI determination. 32 C.F.R. 117.56(b)(14)(v). This DSS authority is yet another reason for cleared contractors contemplating corporate combinations to understand and begin the FOCI mitigation process as early in the combination timeline as possible. Companies should also be aware that, if DSS receives a FOCI analysis request which causes DSS to believe that the proposed transaction should be subject to CFIUS, the DSS is to notify CFIUS of the transaction.
The new DoD regulations do not change the factors against which potential FOCI is analyzed or the methods used to mitigate or negate the presence of FOCI. In contrast, they do present a timing challenge for cleared companies seeking to close a corporate combination and maintain an uninterrupted facility clearance.