A Primer on CFIUS for Medtech Startups

Raising capital, product development and commercialization, and a successful exit are top priorities of emerging and growth-stage medtech companies. Given the cross-border nature of business in the twenty-first century, these companies are frequently faced with the opportunity to take investment dollars from a foreign investor, enter a joint venture with a foreign partner, or be acquired by a foreign buyer. Particularly over the last few years in a difficult economic environment, U.S. medtech companies have had to look beyond the borders of the U.S. for potential partners, investors, and acquirers.

As business teams (rightfully) focus on increasing the value of a company through strategic partnerships and investments and pursuing attractive exit opportunities, there are important regulatory requirements applicable to each of these types of transactions if they involve foreign parties about which many companies are unaware. The failure to comply with these requirements could not only spell financial ruin for a company but could also result in criminal and significant civil penalties, divestitures, or even the retroactive unwinding of a transaction.

Accordingly, the purpose of this article is to provide a high-level overview of the regulatory framework overseen by the Committee on Foreign Investment in the United States (CFIUS) and to flag the issues companies should consider as they discuss potential partnerships, investments, or acquisitions with foreign parties.

What Is CFIUS?

CFIUS is an inter-agency committee headed by Department of the Treasury and is concerned with protecting the national security of the United States with respect to foreign ownership or control of certain U.S. businesses. CFIUS has in recent years prioritized the protection of certain types of intellectual property from being disclosed to certain foreign parties (especially Chinese parties). CFIUS is authorized to review, and in some cases, oversee or block certain transactions, including those that:

Medtech companies are of great interest to CFIUS because their product and service offerings frequently involve sensitive data of U.S. citizens (such as biometric data, geolocation data, and genetic data), or digital health, artificial intelligence, biotech, diagnostic, wearable, robotic, or other forms of new technology. Moreover, these companies frequently raised capital from, are acquired by, or enter into a joint venture with foreign parties.[1]

CFIUS filings

Depending on the nature of a transaction, the parties may be obligated to obtain CFIUS clearance before closing through the submission of a joint filing setting forth the material terms of the transaction and information about the parties. In certain cases, a CFIUS filing is mandatory and the parties must obtain CFIUS clearance before closing. Even in cases where a CFIUS filing is only voluntary, there can be significant benefits to making a voluntary filing and heavy consequences for failing to make one. The only way to guard against CFIUS engaging in a unilateral review of the transaction post-closing (and potentially unwinding the transaction, requiring the parties to put in place certain mitigation measures, and/or implementing criminal and civil penalties) is to obtain CFIUS clearance for the transaction. In some cases, it’s not entirely clear whether a transaction gives rise to a mandatory filing obligation or whether CFIUS would have jurisdiction to review it, and depending on the parties’ appetite for risk, a voluntary filing is the only way to get the comfort that some parties crave. Transactions that involve “rival” countries (like China) or certain types of emerging technology should be given extra consideration as to whether to make a voluntary filing.

CFIUS scrutiny is here to stay and will likely continue to increase in the future

CFIUS has increased its resources over the past few years to enable it to diligently monitor and review transactions, even post-closing. CFIUS imposed the greatest number of penalties in its history during 2023, and there are currently proposed regulations and legislation that would further bolster CFIUS powers and intensify the penalties it can impose.[2] It was directed by the Biden Administration[3] to closely scrutinize transactions involving the artificial intelligence technology, biotechnology, and biomanufacturing sectors (among others), and the Office of the Director of National Intelligence warned emerging companies to be extra vigilant about the dangers of foreign investors.[4] Moreover, the White House Office of Science and Technology Policy has designated artificial intelligence technology and biotechnology as potentially significant to U.S. national security.[5] These developments along with other pending legislation[6] underscores that CFIUS scrutiny of transactions in these and other sectors is here to stay, and will likely only intensify in the coming years.

What does this mean for medtech companies?

Medtech companies should consider the CFIUS implications of any transaction that involves a foreign person as early as possible in the deal process. For these companies, CFIUS will come up most frequently in the contexts of:

Companies that offer products or services involving digital health, artificial intelligence, biotech, diagnostic, wearable, robotic, or other forms of new technology should be on particularly high alert because these types of technology could give rise to a mandatory CFIUS filing requirement for certain capital raising, development and commercialization, and exit transactions.

CFIUS issues should be analyzed early on in the deal process so that a transaction can be structured and timed appropriately from the outset to address potential CFIUS implications of the transaction (including due diligence protocols, deal timeline, responsibility of preparing filings, conditions to closing, risk allocation, and fee and cost sharing or reimbursements). CFIUS issues have the potential to derail a transaction or considerably increase the cost and complexity of a transaction, so there are significant advantages to aligning the parties’ expectations at the outset of a deal process. This is particularly important for emerging and growing companies who typically operate on limited financial resources, as it could be financially fatal for the company if a foreign investor, partner, or acquirer backs out of or is prohibited by CFIUS from doing a transaction after the company has spent precious dollars and time pursuing it.

Even if a filing is not required, the parties should discuss the pros and cons of making or not making one with each other and their legal counsel so that their decision aligns with their appetite for risk and business objectives and is justifiable in the event that CFIUS were to unilaterally review the transaction post-closing. Whether CFIUS has jurisdiction and issues about filing decisions are both fact-intensive inquiries and should be discussed with competent CFIUS counsel who is familiar with not only the complex and evolving regulatory landscape but also the parties’ businesses and objectives.

[1] The CFIUS Regulations, which can be found at 31 C.F.R. Part 800 et seq., are nuanced and are summarized at a high level in this article as pertinent to emerging medtech companies.

[2] See, e.g., Notice of Proposed Rulemaking released by the Department of Treasury on April 15, 2024 available at:  2024-07693_0.pdf (SECURED) (treasury.gov).

[3] See Executive Order 14083 of Sep. 15, 2022.

[4] See Joint Bulletin to U.S. Emerging Technology Companies (July 2024).

[5] See Critical and Emerging Technologies List Update: A Report by the Fast Track Action Subcommittee on Critical and Emerging Technologies of the National Science and Technology Council (Feb. 2024).

[6] See Biosecure Act (H.R. 8333).