CFIUS Shows Enforcement Teeth in Record T-Mobile Penalty

Agency action reflects increased focus on enforcement and accountability.

On August 14, 2024, the U.S. Treasury Department unveiled a new, updated Enforcement page on its website¹ providing new transparency with regard to enforcement actions by the Committee on Foreign Investment in the United States (CFIUS).

The update included a list of eight relatively recent CFIUS enforcement actions. One was for multiple material misstatements in a joint filing; the others, however, involved fines for failure to comply with mitigation agreements.

Revealed in the list of actions: a record $60 million penalty imposed against T-Mobile US, in settlement of violations of the 2018 National Security Agreement (NSA) upon which CFIUS’ approval of T-Mobile’s (a German-controlled company) subsequent $23 billion merger with Sprint in 2020 was conditioned. According to CFIUS, it concluded that T-Mobile breached the NSA by failing to appropriately safeguard access to certain sensitive data, thereby jeopardizing U.S. national security equities. T-Mobile has stated in the press that it “reported [the problems] in a timely manner, and the issue was quickly addressed”;² CFIUS evidently disagreed, finding that the company “… failed to report some incidents of unauthorized access promptly to CFIUS,” delaying the agency’s investigation and mitigation efforts.³ Further details were not provided.

The action appears to align with a principal theme of CFIUS’ recent 2023 Report to Congress: an increased focus on (and investment of staff and resources in) more closely monitoring and auditing compliance with the terms of NSAs, Letters of Assurance, mandated divestitures and other mitigation agreements entered into to resolve national security concerns with certain foreign investments in U.S. entities, technology and specified real estate; and a significantly more aggressive approach to enforcing those agreements. Assistant Treasury Secretary Paul Rosen said in the release accompanying the website unveiling, “In the last few years, CFIUS has redoubled its resources and focus on enforcement and accountability, and that is by design. Today’s penalty updates underscore CFIUS’s commitment to accountability and the protection of national security.”

While the startling $60 million fine in this case represents the largest monetary penalty ever imposed by CFIUS, it’s nevertheless part of a trend. CFIUS has issued six penalties in the last 18 months, triple the number previously issued in its entire history since enactment in 1975.

Also remarkable is CFIUS’ specific identification, in this instance, of the parties (T-Mobile and Sprint) to the agreement, which is highly unusual. CFIUS does not normally identify parties, and is customarily careful about the confidentiality of transactions. Notably, none of the other enforcement actions cited on the updated page names the parties involved. That they are named in this case is evidently meant to send a message regarding the potential severity of the consequences of noncompliance.

And that message is clear: CFIUS is intent on using its expanded resources to monitor and, where appropriate, substantially penalize noncompliance with its filing regulations and (perhaps especially) with the terms of national security/mitigation agreements. Parties to CFIUS mitigation agreements, and those engaged in negotiating them, would be well-advised to ensure the establishment of effective internal compliance controls and reviews as part of their transaction/acquisition strategy — and be prepared for potentially rigorous auditing and compliance reviews in this heightened enforcement environment.

Additional Assistance

For more information regarding this legislation, or other trade law matters, please contact James Kevin Wholey at (202) 617-2714, jwholey@phillipslytle.com; any member of the Phillips Lytle International Business Law Team; or the Phillips Lytle attorney with whom you have a relationship.