The Dawn of a Bifurcated World: How U.S. Investment and Technology Restrictions against China in 2024 Increasingly Impact the World

Summary:

• In 2024, the United States continued to impose new investment and technology restrictionson Chinese interests.
• The difference between that year and preceding years’ restrictions was the impact those restrictions are having on third countries.
• Key legislative changes in 2024 included i) the final rules for reverse CFIUS, ii) an expansion of CFIUS’ investigative power, iii) enhanced and extraterritorial export controls on semiconductors, semiconductor equipment, memory chips, and quantum computing, iv) the continued enforcement of global sanctions, v) final rules for restrictions on the cross-border flow of data to “countries of concerns”, and vi) an executive order that paves the way for restrictions on inbound e-commerce.
• Market participants in third countries should not be lulled into thinking that they can ignore U.S. restrictions on China, as those restrictions are increasingly having an extra-territorial effect on them.

“The increasingly extraterritorial nature of these new and proposed restrictions was a defining feature in 2024 and portends to more restrictive actions in 2025 and beyond”

In 2024, the United States largely followed through with restrictions it previously proposed to place on Chinese interests, while announcing new tools to eliminate what it views are chokepoints in the U.S.-China technology competition. The increasingly extraterritorial nature of these new and proposed restrictions was a defining feature in 2024 and portends to more restrictive actions in 2025 and beyond. Those actions will not only impact China, but a wide range of third countries, too.

Key U.S. Legislation Impacting Chinese Interests 

Final Rules for Reverse CFIUS

On October 28, 2024, the U.S. Department of Treasury issued final regulations implementing “reverse CFIUS”, namely the Provisions Pertaining to U.S. Investments in Certain National Security Technologies and Products in Countries of Concern (the “Final Reverse CFIUS Regulations”). The Final Reverse CFIUS Regulations took effect on January 2, 2025.

Appendix 1 sets out a decision tree for the “reverse CFIUS” regime asconstituted under the Final Reverse CFIUS Regulations.

Private equity and venture capital funds with general partners in non-PRC, non-U.S. jurisdictions should not assume that the Final Reverse CFIUS Regulations do not apply to them. On the contrary, the limited exemptions for U.S. limited partner investments means that these funds will also have to face the choice to forgo investment in prohibited or notifiable transactions, or forgo receiving meaningful U.S. investment. This is true even if the general partner is from U.S.-allied jurisdictions such as Canada, the United Kingdom, the countries in the European Union, and Australia. As a result, non-PRC, non-U.S. funds with global reach may consider forming separate parallel funds without U.S. investors, who will then invest in the sectors prohibited or notifiable under the Final Reverse CFIUS Regulations.

“The Final Reverse CFIUS Regulations should be viewed as a starting point, not an end”

The Final Reverse CFIUS Regulations should be viewed as a starting point, not an end. The list of “countries of concern” can increase, and the list of prohibited or restricted transactions can expand.

Expansion of CFIUS’ Investigative Powers

On November 18, 2024, the United States Department of Treasury issued a final rule: Penalty Provisions, Provision of Information, Negotiation of Mitigation Agreements, and Other Procedures Pertaining to Certain Investments in the United States by Foreign Persons and Certain Transactions by Foreign Persons Involving Real Estate in the United States (the “Final CFIUS Rules”). These rules took effect on December 26, 2024.

The Final CFIUS Rules contain the following key provisions: (1) to effectively deny a transaction if the transaction parties do not respond to mitigation terms proposed by CFIUS within a timeframe set forth by CFIUS; (2) providing CFIUS with the ability to request information from “other persons” who are not transaction parties about a particular transaction, including a non-filed transaction; (3) expanding the penalties for making a material misstatement from a base rate of US$250,000 to US$5 million per violation and (4) expanding the penalties for non-compliance of a mitigation agreement from a base rate of US$250,000 to the greater of i) US$5 million, ii) the value of the violator’s interest in the relevant U.S. business at the time the transaction closed, iii) the value of the violator’s interest in the relevant U.S. business at the time the violation occurred, or iv) the value of the transaction when it was filed with CFIUS.

With respect to item (1) above, the ability to effectively deny a transaction if the transaction parties do not respond to mitigation terms proposed by CFIUS by a specified deadline closes a loophole in existing practice whereby the transaction parties can engage in delay with the hopes of securing a more favorable outcome.

With respect to item (2), this includes the issuance of a subpoena on a discretionary basis, compared to a prior standard based on necessity. The ability to require information from “other persons” who are not transaction parties, including by way of legally binding subpoena, with a penalty of up to US$5 million if such information is not provided or is misleading or contains material omission, is potentially significant in practice. It would allow CFIUS to make broad queries to market participants, instead of having to find out by itself and then focus on the transaction parties. For example, CFIUS could broadly query the venture capital and private equity firms in Silicon Valley, New York, Boston and other hubs about the shareholding structure of start-ups and established companies alike, along with information on the investors who have invested in them. Specifically, it could require an established Silicon Valley venture capital fund to reveal the capitalization table of all of its portfolio companies, allowing CFIUS to focus on the ones with shareholders from “countries of concern” (i.e. China). The result may be CFIUS finding more investors from “countries of concern”, and the companies who have received their investment, leading to more investigations of transaction parties in previously non-filed transactions.

With respect to the impact of the Final CFIUS Rules on third countries, much attention has been placed recently on CFIUS scrutiny of Japanese acquirers with significant operations in China, such as the ongoing CFIUS review of Nippon Steel’s proposed acquisition of U.S. Steel. CFIUS previously imposed mitigation terms on Softbank in respect of its significant investment in Cruise, where Softbank had to undertake not to share information it obtained about Cruise with its other portfolio companies in China.

Enhanced and Extraterritorial Export Controls

On September 5, 2024, the Bureau of Industry and Security (BIS) of the U.S. Department of Commerce released the Implementation of Controls on Advanced Technologies Consistent with Controls Implemented by International Partners (the “Worldwide Controls”). The Worldwide Controls introduced a new concept in U.S. export controls that applies export controls on non-defense related items on a worldwide basis, namely in the fields of quantum computing and advanced computing chip technologies, subject to an important, newly-created exemption: License Exception Implemented Export Controls (IEC). The IEC exemption applies to jurisdictions that BIS has deemed to have implemented export controls that are equivalent to that of the Worldwide Controls. A current list of IEC jurisdictions reveals they consist of only the G7 jurisdictions (i.e. Canada, France, Germany, Italy, Japan and the United Kingdom), along with Australia and Spain.For any other jurisdiction, the Worldwide Controls require a license from BIS before export.

On December 2, 2024, BIS issued a fresh set of export controls targeting for the first time advanced memory chips, while also expanding the foreign direct product rule for advanced semiconductor manufacturing to Country Group D:5 countries plus Macau.

The standard for license review is a case-by-case analysis at BIS’s discretion, except for Country Group D:5plus Macau, along with entities headquartered or whose ultimate parent is headquartered in such jurisdictions, which will be reviewed on a presumption of denial. The primary Country Group D:5 jurisdiction is the PRC, along with Southeast Asian and Middle Eastern jurisdictions.

“U.S. export controls in emerging technological fields are no longer specifically targeted at the PRC”

These new export controls, which apply not only to the PRC but other jurisdictions worldwide, may have profound implications for non-U.S. technology start-ups, multinationals, and private equity and venture capital investors who operate or invest in the affected fields, or who rely on suppliers from the affected fields. U.S. export controls in emerging technological fields are no longer specifically targeted at the PRC. They now apply to the Middle East, Southeast Asia, and even Western jurisdictions (presently) such as the Netherlands, Ireland, Scandinavia, and South Korea.

As U.S. suppliers may be subject to both civil and criminal liability if they are in breach of U.S. export controls, and given recent high-profile enforcement actions against them such as the ongoing criminal investigation of Applied Materials, non-U.S. parties operating in the affected fields should expect rigorous customer due diligence and compliance undertakings from such U.S. suppliers. Based on BIS’s focus on the PRC and its updated “red flag” guidance of December 2, 2024, this due diligence may focus on end users and may also work alongside other extraterritorial elements of U.S. export controls such as the foreign direct product rule.

Global Sanctions

On December 22, 2023, U.S. President Biden issued the Executive Order on Taking Additional Steps With Respect to the Russian Federation’s Harmful Activities, which amended prior executive orders to expressly allow the U.S. to impose secondary sanctionson non-U.S. financial institutions who facilitate transactions prohibited by the U.S. (for example, semiconductors, machine tools, optical and navigation systems, and turbine oil). A precondition for potential secondary sanctions is the requirement for the trade to be with the “technology, defense, and related material, construction, aerospace, or manufacturing sectors of the Russian Federation economy, or other such sectors as may be determined to support Russia’s military-industrial base”. In a new set of FAQs issued on June 12, 2024, the Office of Foreign Assets Control (OFAC) determined “military-industrial base” to include all entities that have been sanctioned by OFAC, “as well as any person operating in the technology, defense and related materiel, construction, aerospace, and manufacturing sectors of the Russian Federation economy”. This FAQ interpretation provides certainty that sanctioned entities will always be covered under this executive order.

Using its authority under Executive Order 14071 Prohibiting New Investment in and Certain Services to the Russian Federation in Response to Continued Russian Federation Aggression, on June 12, 2024, OFAC issued a determination prohibiting U.S. persons from providing to Russian customers IT consultancy and design services, as well as IT support services and cloud-based services for enterprise software and design and manufacturing software.

On November 21, 2024, OFAC issued an alert reminding non-U.S. financial institutions that secondary sanctions are possible if they join the Russian financial messaging system SPFS.

Restrictions on the Cross-Border Flow of Data

On February 28, 2024, President Biden issued the Executive Order on Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern. Concurrently, the Department of Justice issued an Advanced Notice of Proposed Rulemaking, the Provisions Regarding Access to Americans’ Bulk Sensitive Personal Data and Government-Related Data by Countries of Concern. On October 21, 2024, it issued the Notice of Proposed Rulemaking. On December 27, 2024, it issued the final rules titled Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern, which will be effective three months after issuance. The final rules create a framework that regulates for the first time the cross-border flow of data from the United States to “countries of concern” (such as China, including Hong Kong).

The proposed rules prohibit “covered data transactions” involving data brokerage (i.e. government or bulk U.S. sensitive personal data that is sold or licensed to a covered person) and human genomic data. It restricts “covered data transactions” involving vendor agreements, employment agreements, and non-passive investment agreements. Restricted transactions require security standards that effectively amount to data anonymization.

Of note, the final rules contain working examples that provide clarity over whether inter-group transactions are “covered data transactions” involving bulk U.S. sensitive personal data. Except in the cases of personal communications subject to the Bremer amendment (which would save TikTok from these rules), they are. In one example, a U.S. subsidiary of a parent headquartered in a “country of concern” operates an autonomous driving platform in the U.S. that collects precise geolocation data of its cars. The license of such data from the U.S. subsidiary to the parent is a prohibited transaction. In another example, the U.S. subsidiary of a parent headquartered in a “country of concern” develops an AI chatbot with covered data sourced from the U.S. To the extent its parent can access the raw data underlying the AI chatbot, such access would be considered a prohibited transaction.

The final rules also contain a “backdoor CFIUS” as a restricted transaction. Non-passive investments in U.S. companies by entities in “countries of concern” are now restricted and subject to the security standards in the rules. This is true even if the underlying transaction was cleared by CFIUS without conditions.

These final rules should be viewed as a first step in the creation by the U.S. of a comprehensive national data privacy framework akin to the GDPR and the cybersecurity laws of the PRC.

Proposed Restrictions on Inbound E-Commerce

On September 13, 2024, President Biden announced his intention to introduce new rules to reduce or eliminate the de minimis exemption of $800 for small packages as it relates to the items that would otherwise be subject to tariffs if the current de minimis exemption did not exist. The announcement also urged Congress to pass laws that would have a similar impact as the proposed rules. If enacted, the current business model of Shein, Temu, and other China based e-commerce providers that rely on the Chinese manufacturing ecosystem may be significantly and adversely impacted.

“Final rulemaking at the Presidential level will be left to the incoming Trump administration, who have expressed no hesitation to impose tariff barriers broadly”

Final rulemaking at the Presidential level will be left to the incoming Trump administration, who have expressed no hesitation to impose tariff barriers broadly. Another tool would be to place Shein, Temu, and other Chinese e-commerce providers on the UFLPA’s entity list, which would deny entry into the United States of all of their packages. Implementation would have to account for transshipments (shipments of packages through third parties from third countries), which would most likely require cooperation from the authorities of such third countries in order for the rules to be effective. That said, the Trump administration could encourage compliance by the affected companies by placing them, or threatening to place them, on the export control “entity list” or using sanctions authorities, such as placing the founders and management teams involved in decision-making onto the SDN list.

Outlook for 2025

The aggregate impact of the U.S. restrictions, along with the PRC’s own implementation of its offshore IPO rules (i.e. effectively barring VIE structures), has all but ended a once thriving venture capital and private equity ecosystem where U.S. investors would fund Chinese start-ups from inception to exit, resulting in largely positive returns for all parties. The new U.S. restrictions have also led many U.S. multinationals to preemptively create internal systems to “ringfence” their China operations from the uncertainties that may arise from other parts of their business.

The increasingly extraterritorial nature of the U.S. restrictions against China, and the potential for Chinese retaliation, mean that commercial interests from third countries (i.e. not U.S. or China) should in 2025 proactively create internal systems to de-risk their operations in both the U.S. and China, so as to maintain their business operations in these key markets.

The examples of Nippon Steel’s proposed purchase of U.S. Steel and G42’s licensing applications for U.S. advanced semiconductor exports to it following Microsoft’s investment in G42, are instructive. Each case involved a third country that was neither the U.S. nor China (i.e. Japan in the case of Nippon Steel and UAE in the case of G42). Yet in each case, the U.S. expressed concerns about their connections to China. In the case of Nippon Steel, CFIUS was concerned about Nippon Steel’s substantial operations in China, while in the case of G42, BIS was concerned about G42’s supply chain with Chinese interests.

In 2025, given the enactment of reverse CFIUS, the focus could shift to third country investments funds who do not want to limit their investment targets and would therefore need to find solutions to ringfence their U.S. focused and China focused operations. This could be the case for Middle Eastern wealth funds and investors, given their recent investments in both the U.S. and China.