o In the case of a Failure to File, the date of the transaction at issue.
Response and Remediation

o Whether the Subject Person submitted a self-disclosure, including the timeliness,
nature, and scope of information reported to CFIUS.

© Whether the Subject Person cooperated completely in the investigation of the matter
(e.g., providing timely and detailed responses).

o The promptness of complete and appropriate remediation of the conduct, including the
remedial steps taken upon learning of a Violation.

o Whether there was an internal review of the nature, extent, origins, and consequences
of the conduct to prevent its reoccurrence.

Sophistication and Record of Compliance

© The Subject Person’s history and familiarity with CFIUS and, if applicable, past
compliance with CFIUS Mitigation.

© Internal and external resources dedicated to compliance with applicable legal
obligations (e.g., legal counsel, consultants, auditors, and monitors).

© Policies, training, and procedures in place to prevent the conduct and the reason for the
failure of such measures.

© Variation in the consistency of compliance, both horizontally across the entity, and
vertically from directors and officers to supporting staff.

o The compliance culture that exists within the company (e.g., demonstrated
commitment to compliance with applicable legal obligations).

© The experience of other federal, state, local, or foreign authorities with knowledge of
the Subject Person in the assessment of the quality and sufficiency of compliance with
applicable legal obligations.

o Inthe case of a Violation of CFIUS Mitigation, the extent to which written compliance
policies or training on the terms of the relevant CFIUS Mitigation were communicated
and implemented across the entity.

9 Inthe case of a Violation of CFIUS Mitigation, the extent to which the authority, role,
access and independence of any security officer were sufficient and in compliance with
the terms of the CFIUS Mitigation.


Aggravating and Mitigating Factors

When determining any appropriate penalty in response to a Violation — including

determining the appropriate amount for the penalty - CFIUS engages in a fact-based analysis in
which it weighs aggravating and mitigating factors. The weight CFIUS gives to any factor will
necessarily vary depending on the particular facts and circumstances surrounding the conduct
giving rise to the Violation. Factors that are relevant in the context of one Violation will not
necessarily be relevant in the context of another. Some factors that CFIUS may consider
aggravating or mitigating in determining an appropriate response to a Violation include this non-
exhaustive list (presented in alphabetical order):

Accountability and Future Compliance

o The impact of the enforcement action on protecting national security and ensuring that
Subject Persons are held accountable for their conduct and incentivized to ensure
compliance, including promoting compliance and cooperation with Section 721, such
as through self-disclosures, where appropriate!

Harm

© The extent to which the conduct impaired or threatened to impair U.S. national security.

Negligence, Awareness, and Intent

o The extent to which the conduct was the result of simple negligence, gross negligence,
intentional action, or willfulness.

© Effort to conceal or delay the sharing of relevant information with CFIUS.

© The seniority of personnel within the entity that knew or should have known about the
conduct.

Persistence and Timing

© The length of time that elapsed after the Subject Person became aware, or had reason
to become aware, of the conduct, and before CFIUS became aware of the conduct
and/or its remediation.

o The frequency and duration of the conduct.

© In the case of a Violation of CFIUS Mitigation, the length of time since the CFIUS
Mitigation was issued or became effective.

‘ Consistent with the goal of promoting compliance and cooperation with Section 721, CFIUS will continue its
practice of publishing on its website information related to specific enforcement actions, but without disclosing
information that is subject to confidentiality under section 721(c) of the Defense Production Act of 1950 as amended
(50 U.S.C. § 4565(c)).


* * *

These Guidelines are non-binding and are not intended to, do not, and may not be relied
upon to create any right or benefit, substantive or procedural, enforceable at law by any party in
any administrative, civil, or criminal matter. They can and will be updated as circumstances
require.

The applicable statutes and regulations govern all CFIUS activities, and in the event of any
inconsistency between these Guidelines and the applicable statutes and regulations, the applicable
statutes and regulations shall prevail. For additional information, please see 50 U.S.C. § 4565, 31
C.F.R. §§ 800.901, 800.902, 801.409, 802.901, and 802.902.


DEPARTMENT OF THE TREASURY
WASHINGTON, D.C.

ASSISTANT SECRETARY October 20, 2022

MEMORANDUM FOR: COMMITTEE ON FOREIGN INVESTMENT IN
THE UNITED STATES

FROM: Paul M. Ros:
Assistant Sec! of the Treasury for Investment Security

SUBJECT: CFIUS Enforcement and Penalty Guidelines

The Committee on Foreign Investment in the United States (“CFIUS” or the “Committee”’)
is responsible for reviewing covered transactions and mitigating any risk to the national security
of the United States that arises as a result of such transactions. As part of this mandate, CFIUS is
often required to negotiate or impose mitigation terms to resolve national security issues. Ensuring
compliance and accountability with these and other legal obligations of transaction parties is a top
priority of CFIUS. To guide the Committee’s assessment of these important issues, the Committee
has adopted the following Enforcement and Penalty Guidelines (the “Guidelines”).

Section 721 of the Defense Production Act of 1950, as amended (50 U.S.C. § 4565)
(“Section 721”), authorizes CFIUS to impose monetary penalties and seek other remedies (e.g.,
directed notices, action plans) for violations of Section 721, the regulations promulgated
thereunder, or mitigation orders, conditions, or agreements pursuant thereto (each of these referred
to herein as a “Violation”). The U.S. Department of the Treasury’s Office of Investment Security
(“OIS”) administers the regulations that address the imposition of such penalties and other
remedies under Section 721: 31 C.F.R. §§ 800.901, 800.902, 801.409, 802.901, and 802.902.
These Guidelines describe three categories of conduct that may constitute a Violation, the process
the Committee generally follows in imposing penalties, and some of the factors it considers in
determining whether a penalty is warranted and the scope of any such penalty. These Guidelines
also highlight the importance of prompt and complete self-disclosure of any conduct that may
constitute a Violation. In these Guidelines, we refer to the person (whether an individual or entity)
who may be liable to the United States for a monetary penalty or otherwise be subject to one of
the other remedies provided for in the CFIUS regulations as the “Subject Person.”

CFIUS penalties and other remedies under Section 721 are available without prejudice to

civil or criminal penalties that may be applicable under other authorities, and CFIUS may refer
conduct to other government enforcement authorities where appropriate.

Types of Conduct That May Constitute a Violation

These Guidelines address three categories of acts or omissions that may constitute a Violation:

« Failure to File. Failure to timely submit a mandatory declaration or notice, as applicable.


¢ Non-Compliance with CFIUS Mitigation. Conduct that is prohibited by or otherwise
fails to comply with CFIUS mitigation agreements, conditions, or orders (“CFIUS
Mitigation”).

e Material Misstatement, Omission, or False Certification. Material misstatements in or
omissions from information filed with CFIUS, and false or materially incomplete
certifications filed in connection with assessments, reviews, investigations, or CFIUS
Mitigation, including information provided during informal consultations or in response to
requests for information.

As described in further detail below, a Violation will not necessarily lead to a penalty or
other remedy under Section 721. CFIUS will exercise its discretion in determining when a penalty
is appropriate, including by considering applicable aggravating and mitigating factors.

Sources of Information on which CFIUS Relies

In determining whether a Violation has occurred, CFIUS considers information from a
variety of sources, including from across the U.S. government, publicly available information,
third-party service providers (e.g., auditors and monitors), tips, transaction parties, and filing
parties.

© Requests for Information. CFIUS often requests information to support its monitoring
of compliance with CFIUS Mitigation, as well as to investigate whether a Violation has
occurred and what enforcement action, if any, should be taken. As noted below, if CFIUS
determines that a Violation has occurred, it will consider the Subject Person’s cooperation
in response to requests for information in determining what action, if any, to take. In
addition to providing the requested information, parties may choose to provide any
exculpatory evidence, as well as any defense, justification, mitigating factors, or
explanation for the conduct at issue.

* Self-Disclosures. The Committee strongly encourages any person who engaged in conduct
that may constitute a Violation to submit a timely self-disclosure, even if not explicitly
required by any applicable CFIUS Mitigation or any other law or regulation. A self-
disclosure should take the form of a written notification describing all of the conduct that
may constitute a Violation and all of the persons involved. As noted below, CFIUS will
consider the timeliness of any self-disclosure in determining the appropriate response to a
Violation. In assessing timeliness, CFIUS will consider whether discovery of the conduct
at issue by CFIUS or other government officials has already occurred or was imminent
prior to the self-disclosure. CFTUS will also consider whether the reporting party or parties
complied with any applicable CFIUS Mitigation requiring the disclosure of the conduct.
For the avoidance of doubt, these Guidelines do not replace or modify any reporting or
notification requirements provided for under any applicable CFIUS Mitigation or any other
law or regulation. Where discovery of conduct that may constitute a Violation requires
further investigation, the Subject Person may submit an initial self-disclosure and follow it
up with a more detailed self-disclosure.


¢ Tips. If anyone believes that a Violation may have occurred, CFIUS encourages them to
submit tips, referrals, or other relevant information to the CFIUS tips line found on the
CFIUS Monitoring & Enforcement page at _https://home.treasury.gov/policy-
issues/international/the-committee-on-foreign-investment-in-the-united-states-cfius/cfius-
monitoring-and-enforcement.

To report conduct related to a transaction that is under review by CFIUS, the appropriate
points of contact are those notified to the filing parties by OIS. To report conduct related to CFIUS
Mitigation, the appropriate points of contact are the CFIUS Monitoring Agencies. To report other
failures to comply with Section 721, such as failing to submit a mandatory declaration or notice,
the appropriate point of contact is the CFIUS tips line. For other points of contact, see the CFIUS
Contact Information page at https://home.treasury.gov/policy-issues/international/the-committee-
on-foreign-investment-in-the-united-states-cfius/cfius-contact-information.

When necessary and appropriate to gather information, CFIUS may use the subpoena
authority provided for in the Defense Production Act, as amended. See 50 U.S.C. § 4555(a).

In certain circumstances, CFIUS may communicate with Subject Persons prior to initiating
the formal penalty process described in the next section. These initial communications are purely
for informational purposes and never constitute any form of waiver of any penalty, remedy, or
other authorities by the government or any defense or excuse for the Subject Person.

Penalty Process

The process for considering and imposing penalties is described in 31 C.F.R. §§ 800.901
and 802.901, or, for certain older transactions, in earlier regulations, as applicable. The key steps
in the penalty process are:

¢ CFIUS sends the Subject Person a notice of penalty, including a written explanation of the
conduct to be penalized and the amount of any monetary penalty to be imposed. The notice
will state the legal basis for concluding that the conduct constitutes a Violation and may
set forth any aggravating and mitigating factors that the Committee considered.

* The Subject Person may, within 15 business days of receipt of a notice of penalty, submit
a petition for reconsideration to the CFIUS Staff Chairperson, including any defense,
Justification, mitigating factors, or explanation. Upon a showing of good cause, this period
may be extended by written agreement between the Staff Chairperson and the Subject
Person.

Ifa petition for reconsideration is timely received, CFIUS will consider it before issuing a
final penalty determination within 15 business days of receipt of the petition, which may
be extended by written agreement between the Staff Chairperson and the Subject Person.

¢ If no petition for reconsideration is timely received, CFIUS ordinarily will issue a final
penalty determination in the form of a notice to the Subject Person.