MEMORANDUM
PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED ATTORNEY WORK PRODUCT
To: James Prentice, Partner; Sandra Tung, Partner
From: Ryan Kowalski, Associate; Megan Chu, Associate
Date: April 10, 2025
Re: CFIUS Mitigation Strategy — Acquisition of Luminex Systems Holdings Inc. by Ardent Capital Partners III LP
Matter No.: 1001-00004
Client: Ardent Capital Partners III LP
Right-click to update Table of Contents
I. Executive Summary
The purpose of this memorandum is to assess the potential national-security mitigation measures that the Committee on Foreign Investment in the United States ("CFIUS") may require in connection with the voluntary joint notice (Tracking No. CFIUS-2025-0087) filed on April 4, 2025, for the proposed acquisition of Luminex Systems Holdings Inc. ("Luminex Holdings") by Ardent Apex Holdings Inc. ("Apex Holdings"), a wholly owned subsidiary of Ardent Capital Partners III LP ("Ardent CP III" or the "Fund"), via reverse triangular merger (the "Transaction"). The aggregate all-cash consideration for the Transaction is approximately $2,800,000,000.
The Transaction constitutes a "covered transaction" within the meaning of 31 C.F.R. Part 800 because Luminex Systems Inc. ("Luminex US"), a Delaware corporation and wholly owned subsidiary of Luminex Holdings, currently holds active contracts with three U.S. federal government agencies:
(i) the Department of Defense ("DOD") — for a logistics software module supporting military supply-chain operations;
(ii) the Department of Energy ("DOE") — for a procurement platform used in energy-sector acquisition activities; and
(iii) the General Services Administration ("GSA") — for an enterprise license providing broad federal-agency access to the Luminex One SaaS platform.
These government contracts involve access to sensitive but unclassified ("SBU") government data, supply-chain information, logistics data, and other information that may implicate the national security of the United States.
The 45-day initial review period under Section 721 of the Defense Production Act of 1950, as amended ("DPA"), commenced upon acceptance of the joint notice and is currently set to expire on May 19, 2025. Given the sensitivity of the foregoing government contracts and significant foreign ownership elements — including the fact that Luminex AG, the operational predecessor and current foreign subsidiary, is a Swiss-headquartered Aktiengesellschaft, and that the Ardent CP III limited-partner base includes sovereign wealth and state-affiliated pension funds, most notably co-investor Northvale Sovereign Holdings Ltd. ("Northvale"), a Cayman Islands exempted limited company with foreign-government affiliations — we consider it highly likely that CFIUS will require the execution of a mitigation agreement, most probably in the form of a National Security Agreement ("NSA"), as a condition to clearance.
Our recommended strategy is to proactively develop and present a comprehensive mitigation package to CFIUS staff at the earliest practicable stage of the review process. This approach is designed to: (a) demonstrate Ardent Capital's commitment to safeguarding national security and preserving the integrity of Luminex US's government operations; (b) expedite the clearance process by narrowing and resolving CFIUS concerns before they escalate; (c) avoid referral to the President for a determination under Section 721(d) of the DPA; and (d) preserve the target closing timeline of Q3 2025 (July–August 2025), well ahead of the Outside Date of September 10, 2025 (which is extendable by up to three months to December 10, 2025 in the event that the sole unsatisfied closing condition is the receipt of regulatory approvals). The elements of our recommended mitigation framework are set forth in detail in Section IV below.
II. Transaction Background
A. Transaction Structure
The Transaction is structured as a reverse triangular merger in which Ardent Apex Merger Sub Inc. ("Merger Sub"), a Delaware corporation incorporated on March 7, 2025, solely for the purpose of effecting the Transaction, will merge with and into Luminex Systems Holdings Inc., a Delaware corporation incorporated on June 14, 2021 (the "Merger"). Upon consummation of the Merger, Merger Sub will cease to exist and Luminex Holdings will survive as a wholly owned subsidiary of Apex Holdings, which is itself a Delaware corporation incorporated on March 5, 2025, and is a direct, wholly owned subsidiary of Ardent Capital Partners III LP.
The Transaction contemplates aggregate all-cash merger consideration of $2,800,000,000, reflecting a per-share price of $20.00 applied to approximately 140,000,000 fully diluted shares of Luminex Holdings common stock. The consideration is subject to a management equity rollover arrangement pursuant to which certain members of Luminex Holdings' senior management team will roll over a portion of their existing equity holdings into the post-closing entity, with such rollover equity valued at $405,020,000. The rollover structure is designed to align the economic interests of continuing management with those of the buyer group and is a standard feature of sponsor-led take-private transactions of this nature.
The Agreement and Plan of Merger (the "Merger Agreement") was executed on March 24, 2025, by and among Luminex Systems Holdings Inc., Ardent Apex Holdings Inc., and Ardent Apex Merger Sub Inc. The Merger Agreement contains customary representations, warranties, covenants, and closing conditions, including conditions relating to the receipt of all required regulatory approvals (including, specifically, CFIUS clearance) and the absence of any governmental order or injunction prohibiting the consummation of the Transaction.
B. Buyer Profile
Ardent Capital Partners III LP is a Delaware limited partnership headquartered at 399 Park Avenue, 42nd Floor, New York, NY 10022. Fund III is a 2023-vintage buyout fund with total capital commitments of $12.5 billion, making it one of the largest mid-to-upper-market technology-focused private equity funds raised in recent years. Across four flagship funds and related co-investment vehicles, Ardent Capital Management LLC and its affiliated entities manage approximately $31.4 billion in aggregate assets under management.
The general partner of Ardent CP III is Ardent Capital GP III LLC, a Delaware limited liability company. The firm was co-founded by Theodore "Ted" Hargrove and Victoria Langford, who serve as Managing Partners and lead the firm's investment activities. The Investment Committee of Fund III, which has ultimate authority over all investment decisions, consists of the following five individuals:
• Theodore "Ted" Hargrove — Co-Founder and Managing Partner
• Victoria Langford — Co-Founder and Managing Partner
• Marcus Ellison — Partner
• Priya Chandrasekaran — Partner
• David Ng — Partner
All five members of the Investment Committee are U.S. persons (i.e., U.S. citizens or lawful permanent residents), and the general partner entity is domiciled in the United States. This is a favorable factor for CFIUS purposes, as it demonstrates that the management and control of the acquiring fund reside with U.S. persons.
Ardent Capital's investment focus spans growth equity and buyout investments in enterprise technology, financial infrastructure, and healthcare information technology. The firm's prior portfolio includes several investments in companies with U.S. government-adjacent operations, though none with the specific national-security nexus presented by the Luminex Transaction.
C. Co-Investors and LP Base
The Transaction includes two co-investors that are participating alongside Ardent CP III through the Apex Holdings equity structure:
Northvale Sovereign Holdings Ltd. has committed $200,000,000 in co-investment equity to the Transaction. Northvale is a Cayman Islands exempted limited company, with its principal contact being Ahmad Al-Rashid, Head of Direct Investments. Based on publicly available information and representations made during the co-investment negotiation process, Northvale is affiliated with a foreign sovereign wealth fund. The identity and national affiliation of the ultimate beneficial owner of Northvale are known to the firm and have been disclosed in the CFIUS filing, but are not detailed in this memorandum for sensitivity reasons. Northvale's participation in the Transaction presents the most significant CFIUS sensitivity, as foreign government-affiliated investment in a company with active DOD and DOE contracts is a core area of CFIUS concern.
Summit Ridge Capital Partners LP has committed $100,000,000 in co-investment equity. Summit Ridge is a Delaware limited partnership located at 161 North Clark Street, Suite 4700, Chicago, IL 60601. The principal contact is Karen Lindstrom, Managing Director. Summit Ridge is a U.S.-domiciled private equity fund and, based on our review, does not present material CFIUS risk. No foreign-government-affiliated investors have been identified in the Summit Ridge investor base.
Beyond the identified co-investors, the broader limited-partner base of Ardent CP III includes sovereign wealth funds and state-affiliated pension funds from multiple foreign jurisdictions. These LP commitments are passive in nature and do not, individually or collectively, confer governance rights, veto rights, or investment-decision authority on any foreign-government-affiliated investor. However, the presence of such LPs triggered the European Union Foreign Subsidies Regulation notification (Case No. FSR.M.2025-0412, filed April 11, 2025) and is likely to be a factor in CFIUS's assessment of foreign government influence over the acquiring entity and, by extension, over the target's national-security-sensitive operations.
D. Target Profile — National Security Nexus
Luminex Systems Holdings Inc. is a Delaware corporation with its operational headquarters located at 2100 Reston Gateway Drive, Suite 800, Reston, VA 20191. Luminex Holdings serves as the U.S. parent holding company for the global Luminex enterprise, a structure that was established in 2021 when the company undertook a corporate reorganization to create a mirrored share arrangement with its original Swiss parent.
Luminex Systems Inc. (Luminex US) is a Delaware corporation and wholly owned subsidiary of Luminex Holdings. Luminex US is the primary operating entity for all U.S. business activities and employs approximately 1,650 individuals in the United States. For the fiscal year ended December 31, 2024, Luminex US reported U.S. revenue of approximately $194,800,000.
The company's core product is "Luminex One," a cloud-based enterprise resource planning ("ERP"), procurement automation, and supply-chain analytics software-as-a-service ("SaaS") platform. Luminex One is deployed by a range of enterprise and government clients and represents the central revenue-generating asset of the business.
Critically for CFIUS purposes, Luminex US holds contracts with three U.S. federal government agencies — the DOD, DOE, and GSA — as described in detail in Section I above. These contracts involve access to sensitive but unclassified government data, including supply-chain information, logistics data, procurement records, and potentially personal information of U.S. government personnel. The nature of this data, and the government's reliance on the Luminex One platform for mission-related functions, creates a direct national-security nexus that CFIUS will scrutinize closely.
Luminex AG is a Swiss Aktiengesellschaft (commercial register number CHE-284.391.057) headquartered in Zürich, Switzerland. Luminex AG was the original corporate entity and served as the global parent prior to the 2021 reorganization. Under the current structure, Luminex AG operates as a subsidiary of Luminex Holdings and is the primary operating entity for the company's European and international business. Additional foreign subsidiaries include Veltronix GmbH (Germany), Luminex UK Limited (United Kingdom), and Luminex Singapore Pte. Ltd. (Singapore).
The global Luminex enterprise employs approximately 4,200 individuals worldwide. For the fiscal year ended December 31, 2024, the company reported total revenue of approximately $487,000,000, comprising $441,000,000 in annual recurring revenue ("ARR") from SaaS subscriptions and $46,000,000 from professional services engagements.
Prior to the announcement of the Transaction, the ownership of Luminex Holdings was distributed as follows:
• 52% — Ridgeline Growth Equity Fund II LP (financial sponsor)
• 20% — Meridian Venture Partners IV LP (venture capital)
• 28% — Management and employees (including equity incentive awards)
III. CFIUS Jurisdictional Analysis
A. Covered Transaction Determination
The proposed acquisition constitutes a "covered transaction" under Section 721 of the Defense Production Act of 1950, as amended by the Foreign Investment Risk Review Modernization Act of 2018 ("FIRRMA"), and its implementing regulations at 31 C.F.R. Part 800. A "covered transaction" is defined, in relevant part, as any transaction that could result in foreign control of, or foreign investment in, any U.S. business, including any merger, acquisition, or takeover that is proposed or pending after August 23, 2018. See 31 C.F.R. § 800.213.
Although the acquiring entity — Ardent Apex Holdings Inc. — is a Delaware corporation managed by U.S. persons, the Merger results in foreign person involvement through multiple channels:
(i) Northvale Sovereign Holdings Ltd., a Cayman Islands entity with foreign sovereign wealth affiliation, will acquire an indirect equity interest in a TID U.S. Business (as defined below) through its $200,000,000 co-investment in the post-closing equity structure of Apex Holdings. While Northvale's economic interest is approximately 6.9% of total post-closing equity and does not, on its own, confer "control" as defined under 31 C.F.R. § 800.208, Northvale's foreign-government affiliation and its potential to exercise influence through information rights, board observation, or informal channels are sufficient to bring the Transaction within CFIUS's jurisdiction.
(ii) The broader LP base of Ardent CP III includes foreign government-affiliated investors — sovereign wealth funds and state-affiliated pension funds — whose aggregate commitments to the Fund, while passive, contribute to the overall foreign ownership profile that CFIUS will evaluate.
Luminex US qualifies as a "TID U.S. Business" — that is, a U.S. business that produces, designs, tests, manufactures, fabricates, or develops one or more critical technologies; owns, operates, manufactures, supplies, or services critical infrastructure; or maintains or collects sensitive personal data of U.S. citizens. See 31 C.F.R. § 800.248. Specifically, Luminex US qualifies based on:
• Its government contracts involving critical technology (the Luminex One platform supports DOD logistics and DOE procurement functions, which may involve technology with national-security implications);
• Its maintenance and processing of sensitive personal data of U.S. government personnel through the Luminex One SaaS platform; and
• Its role in government supply-chain infrastructure, providing analytics and procurement automation to federal agencies responsible for national defense and energy security.
B. Mandatory vs. Voluntary Filing Assessment
The parties elected to pursue a voluntary joint notice under 31 C.F.R. § 800.501 rather than a mandatory declaration under 31 C.F.R. § 800.401. While the mandatory declaration requirement applies to certain transactions involving a TID U.S. Business where a foreign government has a "substantial interest" in the foreign person (generally, a 49% or greater voting interest in the foreign person and a 25% or greater voting interest in the TID U.S. Business), we assessed that the mandatory declaration trigger may not technically apply in this case. Luminex US does not appear to hold International Traffic in Arms Regulations ("ITAR")-controlled technology, nor does it produce items on the Commerce Control List ("CCL") that would independently trigger a mandatory filing obligation. Moreover, the structure of the acquisition — through a U.S.-domiciled private equity fund with U.S.-person control — introduces complexity into the "substantial interest" analysis for any individual foreign-government LP.
Notwithstanding this analysis, we determined that the voluntary joint notice route was strongly preferable for the following reasons:
(a) Maximizing regulatory certainty — a voluntary notice triggers a formal CFIUS review and results in a definitive outcome (clearance, clearance with conditions, or recommendation for Presidential action), eliminating the risk that CFIUS could later initiate a non-notified review and potentially unwind a completed transaction.
(b) Demonstrating good faith — given the sensitivity of the government contracts and the involvement of Northvale, a proactive filing signals the parties' commitment to transparency and cooperation with CFIUS.
(c) Aligning with deal timeline — the Merger Agreement conditions closing on CFIUS clearance; a voluntary notice provides the most predictable timeline for satisfying this condition.
The joint notice was filed on April 4, 2025. The 45-day initial review period commenced upon CFIUS's acceptance of the filing and is expected to expire on or about May 19, 2025. If CFIUS determines during the initial review period that additional investigation is warranted, it may initiate a subsequent 45-day investigation period, which would extend the review timeline through approximately July 3, 2025. A further 15-day Presidential determination period is available following any CFIUS recommendation, though we believe the risk of escalation to the Presidential level is low if an appropriate mitigation framework is offered proactively (as discussed in Section VII below).
C. Key National Security Concerns Anticipated
Based on our experience with CFIUS reviews involving comparable transactions, our analysis of the target's operations and government contract portfolio, and our preliminary informal engagement with CFIUS staff, we anticipate that the Committee's review will focus on the following key national-security concerns:
1. Access to Sensitive Government Data. This is expected to be CFIUS's primary concern. Luminex US's DOD logistics module processes supply-chain and logistics data that, while classified at the "sensitive but unclassified" level, could reveal military supply-chain dependencies, procurement patterns, and logistical vulnerabilities if accessed by a foreign adversary or unauthorized party. The DOE procurement platform handles energy-sector procurement information that could similarly reveal strategic priorities and vulnerabilities in the U.S. energy infrastructure. The GSA enterprise license provides broad government-wide access to the Luminex One platform, potentially exposing data from multiple federal agencies. The aggregate data processed by Luminex US across these three contracts — even if no single data element rises to the classified level — presents a mosaic intelligence risk that CFIUS has demonstrated increasing sensitivity to in recent years.
2. Foreign Government Influence. The participation of Northvale Sovereign Holdings Ltd. as a co-investor, and the presence of sovereign wealth and state-affiliated pension fund LPs in the broader Ardent CP III investor base, raise concerns about the potential for a foreign government to exercise influence over Luminex US's operations, either directly (through governance rights, board representation, or information access) or indirectly (through the economic leverage inherent in a significant capital commitment). CFIUS has been increasingly focused on foreign-government-linked investment in the technology sector, particularly where the target company handles government data or supports critical infrastructure. Even where the foreign-government investor does not hold a controlling or majority stake, CFIUS has required mitigation measures to limit the investor's access to sensitive information and ability to influence national-security-relevant business decisions.
3. Data Residency and Cross-Border Transfers. Luminex One is a cloud-based SaaS platform with a global customer base. Luminex's corporate structure includes operating entities in Switzerland, Germany, the United Kingdom, and Singapore, each of which may have some level of access to the platform's underlying infrastructure, development environments, or customer data. CFIUS will be concerned about the risk that government contract data — or metadata, analytics, or insights derived therefrom — could be accessed from, transferred to, or stored in non-U.S. locations, whether intentionally or through shared development environments, backup systems, or incident-response protocols. The move toward cloud-based delivery models has heightened CFIUS's focus on data residency and architectural segmentation as mitigation requirements.
4. Personnel Security. Certain Luminex US employees who support government contracts may require, or currently hold, personnel security clearances or may have access to controlled unclassified information ("CUI"). The change in ownership resulting from the Transaction may trigger review and reclassification requirements under the National Industrial Security Program ("NISP") and could raise questions about the continued eligibility of Luminex US to perform on government contracts. Of particular note, Dr. Stefan Kessler, the CEO of Luminex Holdings, is a Swiss national and would not be eligible for a U.S. personnel security clearance absent extraordinary circumstances. His continued leadership of the company, while commercially important, will need to be reconciled with CFIUS's expectations regarding the governance and oversight of government contract operations.
5. Supply Chain Integrity. Luminex One provides supply-chain analytics capabilities, and the government contracts specifically leverage these analytics for defense logistics and energy procurement. Compromise of this data — or even access to aggregated, anonymized supply-chain analytics derived from government client data — could reveal government procurement patterns, vendor dependencies, and logistics vulnerabilities. CFIUS has shown heightened concern about supply-chain intelligence risks in recent reviews, particularly in the context of the broader U.S. government focus on supply-chain resilience following the disruptions of 2020–2023 and ongoing geopolitical tensions.
IV. Proposed Mitigation Measures
The following section outlines the comprehensive mitigation framework that we recommend proposing to CFIUS. Each category of measures is designed to address one or more of the national-security concerns identified in Section III.C above. The measures are structured to be robust and credible while preserving, to the extent possible, the operational flexibility that Ardent Capital requires to execute its post-closing value-creation strategy for the Luminex business.
A. Governance and Board Arrangements
1. Security Control Board / Proxy Board. We recommend establishing a Government Security Committee ("GSC") within Ardent Apex Holdings Inc. The GSC would be composed of at least three independent directors, each of whom must be a U.S. citizen holding (or eligible to obtain) appropriate security clearances. The composition of the GSC would be subject to prior approval by CFIUS, and any replacement or removal of a GSC member would similarly require CFIUS approval.
The GSC would be vested with exclusive authority over all matters relating to:
(a) Luminex US's government contracts, including contract performance, modification, renewal, and termination decisions;
(b) Access to, handling of, and protection of classified information, controlled unclassified information, and other sensitive government data processed or stored by Luminex US;
(c) Personnel security matters, including clearance applications, renewals, and revocations for Luminex US employees supporting government contracts;
(d) Compliance with all obligations under the CFIUS mitigation agreement (NSA); and
(e) Any other matter that the GSC or the CFIUS monitoring agency determines has national-security implications.
The GSC would have authority to override board-level decisions of Apex Holdings — including decisions by the Ardent Capital Investment Committee — if the GSC determines that such decisions could compromise national security or government contract compliance. This override authority is a critical element that CFIUS typically insists upon in NSAs involving private-equity-backed acquisitions of government contractors, and we believe proactively offering it will strengthen our negotiating position.
We note that CFIUS may, depending on the severity of its concerns, require a full proxy board arrangement rather than a GSC-within-the-board structure. Under a Proxy Agreement, designated U.S. citizen proxy holders would exercise all voting rights with respect to Luminex US on matters affecting government contracts, classified or CUI data, and CFIUS compliance obligations. The proxy holders would effectively replace the economic owners in the governance of Luminex US's government-facing operations. We recommend proposing the GSC structure as the initial framework but preparing a fallback Proxy Agreement term sheet in the event CFIUS requires greater structural separation.
2. Restriction on Foreign National Board Participation. To address CFIUS concerns regarding foreign national access to sensitive government information, we recommend the following restrictions:
(a) No individual who is not a U.S. citizen or U.S. lawful permanent resident shall serve as a director or officer of Luminex US, or have access to Luminex US government contract data, without the prior written approval of CFIUS.
(b) Ahmad Al-Rashid, as the designated representative of Northvale Sovereign Holdings Ltd., shall be excluded from any board seat, board observer right, or contractual information right that would provide access to information relating to Luminex US's government contracts, government client identities, government data, or CFIUS mitigation compliance.
(c) The Stockholders Agreement governing Ardent Apex Holdings Inc. (to be entered into at closing) shall include specific carve-outs providing that government contract information — including contract terms, performance data, government client identity, and data security arrangements — is excluded from the scope of any standard financial, operational, or portfolio reporting provided to Northvale or any other foreign-government-affiliated investor.
These restrictions are intended to create a clear and verifiable boundary between Northvale (and any other foreign-government-affiliated investor) and the sensitive government-related operations of Luminex US. We note that Ahmad Al-Rashid and the Northvale team should be briefed on these anticipated restrictions at the earliest opportunity — ideally by April 20, 2025, in advance of our submission of the mitigation proposal to CFIUS — to minimize any friction or surprise that could complicate the co-investment relationship.
3. Compliance Officer Appointment. We recommend the appointment of a Government Security Officer ("GSO") at Luminex US. The GSO would serve as the designated individual responsible for day-to-day oversight and implementation of all CFIUS mitigation obligations. The GSO must meet the following qualifications:
(a) U.S. citizenship;
(b) Active security clearance at the appropriate level (Secret or Top Secret, depending on the classification level of information handled under the government contracts);
(c) Relevant experience in government security, industrial security, or compliance oversight; and
(d) No concurrent employment, consulting, or advisory relationship with any foreign-government-affiliated entity.
The GSO would report directly to the GSC on all matters within the scope of the mitigation agreement, and independently to the CFIUS monitoring agency (which we anticipate will be either the Department of Defense or the Department of Energy, depending on agency designation). The GSO would have the authority to suspend or terminate access to government data and systems in the event of a compliance breach or suspected unauthorized access, without requiring prior approval from Luminex US management or the Ardent Capital Investment Committee. This independent authority is a standard feature of CFIUS mitigation frameworks and is essential to demonstrating that the compliance function operates with genuine autonomy.
B. Data Security Protocols
1. Data Segregation and Access Controls. All U.S. government data — including, without limitation, DOD logistics data, DOE procurement data, GSA platform data, and any metadata, analytics, or reports derived from such data — shall be stored exclusively on servers physically located within the United States, operated and maintained by Luminex US personnel who are U.S. citizens or lawful permanent residents.
Luminex US shall implement logical and physical network segmentation between government contract systems and Luminex's commercial SaaS infrastructure. This segmentation must ensure that:
(a) Government contract data resides on dedicated infrastructure that is not shared with commercial customer environments;
(b) Administrative access to government contract systems is restricted to authorized U.S.-person personnel identified on an access control list maintained by the GSO;
(c) No interconnection, bridging, or data-sharing pathway exists between government contract environments and systems accessible by any non-U.S. Luminex entity, including Luminex AG (Switzerland), Veltronix GmbH (Germany), Luminex UK Limited (United Kingdom), and Luminex Singapore Pte. Ltd. (Singapore); and
(d) Network segmentation controls are tested and verified through independent penetration testing on at least an annual basis.
Additionally, Luminex US shall deploy a zero-trust network architecture for all government contract environments. Under this model, no user, device, or application is trusted by default, and all access requests are authenticated, authorized, and encrypted on a per-session basis. Multi-factor authentication ("MFA") shall be required for all access to government contract data and systems, with no exceptions.
2. Cloud Infrastructure Requirements. Government contract workloads — including all production, development, staging, and disaster-recovery environments supporting government client data — shall be hosted in FedRAMP-authorized cloud environments physically located within the continental United States. Luminex US currently utilizes Ridgeway Industries ("Meridian Technologies") GovCloud for certain government workloads; this arrangement should be confirmed and, if necessary, expanded to encompass all government contract environments.
The following specific prohibitions shall apply:
(a) Government data shall not be migrated, replicated, backed up, or cached to any cloud region or data center located outside the United States, including for disaster-recovery or business-continuity purposes;
(b) No cloud management, monitoring, or support tools operated from non-U.S. locations shall have access to government contract environments; and
(c) Any change to the cloud infrastructure provider, region, or configuration for government contract environments shall require prior written approval of the GSC and notification to the monitoring agency.
To provide ongoing assurance of compliance, Luminex US shall engage a CFIUS-approved, U.S.-based cybersecurity firm to conduct annual third-party security audits of all government contract environments. The scope of these audits shall include, at a minimum: data residency verification, access control testing, network segmentation validation, encryption-at-rest and in-transit verification, incident-response capability assessment, and vulnerability scanning. Audit reports shall be made available to the CFIUS monitoring agency within 30 days of completion.
3. Cross-Border Data Transfer Restrictions. No government contract data, CUI, sensitive supply-chain analytics data, or any information derived from government contract performance shall be transferred, disclosed, or made accessible to any non-U.S. affiliate of Luminex or any non-U.S. third party, without the prior written approval of the GSC and, if required by the terms of the NSA, the CFIUS monitoring agency.
Existing intercompany data-sharing agreements between Luminex US and Luminex AG (and other foreign subsidiaries) shall be amended post-closing to include explicit carve-outs for all government-related data. These amendments shall prohibit the sharing of government contract data through any mechanism, including:
(a) Direct data transfers or exports;
(b) Access through shared development, testing, or support environments;
(c) Inclusion in aggregated, anonymized, or de-identified datasets that are shared across the Luminex enterprise;
(d) Access through centralized business intelligence, reporting, or analytics platforms that are accessible by non-U.S. personnel; and
(e) Transfer of data through intercompany service agreements, secondment arrangements, or joint development activities.
We note that the existing intercompany intellectual property licensing arrangement between Luminex US and Luminex AG — under which Luminex US pays a royalty to Luminex AG at a current rate of 4.5% of U.S. net revenues, proposed to be restructured post-closing to a rate of 6.0% — does not, based on our current understanding, involve the transfer of government data. However, the restructuring of this arrangement must be carefully reviewed to ensure that: (i) the revised licensing terms do not create any mechanism, incentive, or justification for cross-border transfer of government data; and (ii) the licensing arrangement is documented in a manner that CFIUS would view as consistent with the data segregation commitments in the NSA. We recommend that the IP licensing restructuring be reviewed by this firm's CFIUS practice before finalization.
C. Cleared Facility Compliance (FOCI Mitigation)
1. Current Clearance Status. An important threshold question is whether Luminex US currently holds, or is required to obtain, a facility security clearance ("FCL") under the National Industrial Security Program ("NISP") administered by the Defense Counterintelligence and Security Agency ("DCSA"). If Luminex US holds an FCL, or if one is required for the performance of its DOD contract, the Transaction will trigger Foreign Ownership, Control, or Influence ("FOCI") mitigation requirements under 32 C.F.R. Part 117 (the "NISPOM Rule"), which are separate from, but typically coordinated with, the CFIUS review process.
Preliminary due diligence indicates that the DOD logistics software module may require Luminex US personnel to access CUI but does not appear to involve access to classified information at the Secret or Top Secret level. If this is confirmed, Luminex US may not currently hold an FCL and may not be required to obtain one. However, this assessment must be verified through direct consultation with Luminex US's existing security officer and review of the DOD contract's security classification guide. We note that the distinction between CUI and classified information is operationally significant — CUI is subject to safeguarding requirements under 32 C.F.R. Part 2002 and the NIST SP 800-171 framework, but does not require an FCL — and our mitigation approach should be calibrated accordingly.
2. FOCI Mitigation Instruments. If FOCI mitigation is required — either because Luminex US currently holds an FCL or because CFIUS requires the establishment of one as a condition of clearance — we recommend proposing a Special Security Agreement ("SSA") as the primary FOCI mitigation instrument.
An SSA permits a company to retain its FCL while under foreign ownership, control, or influence, subject to specific governance and oversight requirements. Under an SSA:
(a) The company's classified operations are overseen by a Government Security Committee composed of outside directors approved by DCSA;
(b) The outside directors must be U.S. citizens with appropriate security clearances and must meet DCSA's independence requirements;
(c) A Technology Control Plan ("TCP") is implemented to restrict foreign national access to classified and export-controlled information at the company's facilities; and
(d) The company is subject to ongoing oversight by DCSA, including periodic inspections and reviews.
The GSC structure proposed in Section IV.A.1 above is designed to be compatible with SSA requirements, such that the same body could serve as both the CFIUS-mandated Government Security Committee and the DCSA-required oversight board. This dual-purpose structure would streamline governance and reduce the compliance burden on Luminex US.
In the event that CFIUS or DCSA determines that an SSA provides insufficient structural separation — for example, if the government contracts are upgraded to involve classified information at the Secret or Top Secret level, or if the scope of foreign-government influence is deemed too significant for an SSA — we are prepared to propose alternative FOCI mitigation instruments, including a Proxy Agreement (under which U.S. citizen proxy holders exercise all governance rights with respect to the cleared entity) or a Voting Trust Agreement (under which a U.S. citizen voting trustee holds legal title to the entity's shares for the benefit of the foreign owners). These instruments provide progressively greater structural separation but impose corresponding limitations on the owners' ability to manage and control the business.
3. Personnel Clearances. As part of the mitigation implementation, Luminex US will be required to identify all employees who currently hold, or are required to hold, personnel security clearances in connection with the government contracts. This inventory must include:
(a) The identity and clearance level of each cleared employee;
(b) The government contract(s) that each clearance supports;
(c) The status of each clearance (active, inactive, pending adjudication, pending reinvestigation); and
(d) Any anticipated changes in clearance requirements post-closing.
Post-closing, Luminex US (through the GSO) must ensure continuity of all existing personnel clearances and must notify DCSA of the change in ownership through the appropriate NISPOM channels. Any lapse in personnel clearances could disrupt government contract performance and would constitute a material compliance failure.
Of particular note, Dr. Stefan Kessler, the CEO of Luminex Holdings, is a Swiss national. As a non-U.S. citizen, Dr. Kessler would not be eligible for a U.S. personnel security clearance under standard DCSA eligibility criteria. Accordingly, Dr. Kessler must be excluded from access to classified information and CUI relating to the government contracts. All government contract oversight must be delegated to the GSO and the GSC. This arrangement is workable given that Dr. Kessler's primary responsibilities center on commercial strategy, product development, and international operations, but it must be clearly documented in both the NSA and any internal delegation-of-authority instruments. We note that Dr. Kessler's management rollover of approximately $142,800,000 (representing 60% of his total $238,000,000 pre-closing equity, with the remainder received as cash consideration) ensures a strong alignment of economic interests with the post-closing success of the company, which is a favorable factor for CFIUS.
D. Government Contract Carve-Outs and Continuity
1. Novation and Assignment. The DOD, DOE, and GSA contracts held by Luminex US may require novation or assignment consent from the applicable contracting officers following the change of control resulting from the Merger. Under the Federal Acquisition Regulation ("FAR") 42.12, a successor entity that acquires all of a government contractor's assets through a merger or acquisition must typically execute a novation agreement with the government to recognize the new entity as the contractor. Alternatively, if the surviving entity retains the same legal identity (as is the case in a reverse triangular merger where the target survives), the government may require only a change-of-name agreement or notification, rather than a full novation.
We note that Section [●] of the Merger Agreement addresses change-of-control consents broadly. The approximately 340 commercial contracts and 26 enterprise license agreements identified as requiring consent include the three government contracts. We recommend that the government contract consent process be managed separately from the commercial consent process, given the distinct regulatory requirements and the sensitivity of the government relationships. Coordination with each contracting officer should commence immediately upon the parties' determination that a mitigation proposal will be submitted to CFIUS.
As part of the mitigation framework, we propose to CFIUS that government contracts be performed exclusively by Luminex US (or, if necessary, a segregated division thereof) with no involvement of non-U.S. entities or foreign-national personnel. This commitment would be codified in the NSA and would provide the government with assurance that the performance of its contracts will not be affected by the change in ownership.
2. Right of First Refusal / Termination Right. To provide the U.S. government with a meaningful enforcement mechanism in the event of non-compliance, we recommend offering CFIUS a contractual commitment that, in the event of a material breach of the mitigation agreement that is not cured within a specified cure period:
(a) The U.S. government retains the right to require divestiture of the government contract business line of Luminex US to a U.S. buyer approved by CFIUS, at fair market value as determined by an independent appraiser;
(b) Ardent Apex Holdings Inc. and its affiliates shall cooperate fully with any such divestiture process, including by providing transition services and data migration assistance for a period of up to 18 months; and
(c) The U.S. government shall receive prior notification — not less than 60 days before the effective date — of any subsequent change in control of Luminex US, whether by sale, merger, reorganization, or otherwise.
This divestiture right is a powerful enforcement tool that CFIUS frequently insists upon in NSAs, and we believe proactively offering it will demonstrate the seriousness of our mitigation commitment.
3. Subcontractor and Supply Chain Controls. Luminex US shall maintain a comprehensive, current list of all subcontractors, vendors, and suppliers engaged in the performance or support of government contracts. This list shall be maintained by the GSO and made available to the GSC and the monitoring agency upon request.
No subcontractor or supplier that is owned or controlled by a foreign national (as determined by reference to beneficial ownership records) shall be engaged in the performance or support of government contracts without prior written approval of the GSC and, if required, the monitoring agency. This restriction applies to both new subcontractor engagements and renewals or extensions of existing subcontractor arrangements.
Supply-chain analytics generated for government clients — including procurement patterns, vendor performance data, and logistics optimization recommendations — shall not be shared with, or accessible by, Luminex AG, Veltronix GmbH, Luminex UK Limited, or Luminex Singapore Pte. Ltd. These analytics shall be treated as government contract data for purposes of the data segregation and cross-border transfer restrictions described in Section IV.B above.
E. Restrictions on Northvale Sovereign Holdings Ltd.
1. Information Access Limitations. Given Northvale's status as a foreign-government-affiliated investor, the mitigation framework must include specific, enforceable restrictions on Northvale's access to information relating to Luminex US's government operations. We recommend the following measures:
(a) Northvale shall be excluded from receipt of any non-public information relating to Luminex US's government contracts, government client identity, government data, or CFIUS mitigation compliance. This exclusion shall apply to all forms of information sharing, including board presentations, investment reports, portfolio reviews, quarterly updates, and ad hoc communications.
(b) The Co-Investment Agreement between Ardent Capital Partners III LP, Ardent Apex Holdings Inc., and Northvale Sovereign Holdings Ltd. (governing Northvale's $200,000,000 commitment) shall be supplemented with a side letter that formally restricts Northvale's information rights to exclude government contract information. The side letter should be negotiated and executed prior to closing and should be disclosed to CFIUS as part of the mitigation package.
(c) Ahmad Al-Rashid, as Northvale's designated representative, shall not be appointed to the board of directors of Apex Holdings, Luminex Holdings, or Luminex US, and shall not hold any board observer right at any entity in the post-closing corporate structure. To the extent that the Co-Investment Agreement or any other agreement provides Northvale with board observer rights at the Apex Holdings level, such observer rights shall be subject to a carve-out excluding all sessions, discussions, materials, and communications involving government contract matters. The GSC (or its chair) shall have the authority to designate specific agenda items or meeting segments as government-related and to exclude Northvale's observer from those portions of the meeting.
2. Voting and Influence Restrictions. Northvale's equity interest in the post-closing structure is approximately 6.9% of total post-closing equity, calculated as $200,000,000 of approximately $2,901,000,000 in total equity sources (comprising $2,800,000,000 in aggregate deal value less the $405,020,000 management rollover, plus the rollover amount, plus the co-investment commitments, structured to net to total equity capitalization). At this ownership level, Northvale does not hold a controlling interest but could, absent appropriate restrictions, exercise influence through consent rights, veto rights, or other protective provisions commonly found in co-investment arrangements.
We recommend the following restrictions:
(a) Northvale's equity interest shall carry no special voting rights, veto rights, consent rights, or blocking rights with respect to government contract operations, CFIUS compliance matters, or any decision within the purview of the GSC.
(b) Northvale shall not acquire additional equity in Apex Holdings or any entity in the Luminex corporate structure that would increase its aggregate direct or indirect ownership to above 10% without prior notification to, and approval by, CFIUS. This ownership cap provides a meaningful safeguard against incremental accumulation of influence.
(c) To the extent that the Co-Investment Agreement provides Northvale with protective provisions regarding material corporate actions (e.g., significant asset sales, additional indebtedness, change of business), such provisions shall be carved out to exclude any decision relating to government contracts or CFIUS compliance.
3. Broader LP Base Protections. Beyond the Northvale-specific restrictions, the mitigation framework should address the broader foreign-government-affiliated LP exposure within Ardent CP III. We recommend the following:
(a) Ardent Capital Partners III LP shall maintain records identifying any limited partner whose aggregate capital contributions derive, in whole or in part, from foreign government sources (including sovereign wealth funds, state-owned enterprises, state-affiliated pension funds, and similar entities). These records shall be updated annually and made available to the CFIUS monitoring agency upon request.
(b) Ardent Capital shall provide an annual certification to the monitoring agency confirming that no foreign government-affiliated LP or investor has acquired influence or control over Ardent Capital's management decisions relating to Luminex US's government business. The certification shall be signed by a Managing Partner of Ardent Capital and the GSO, and shall be supported by documentation demonstrating the continued U.S.-person control of all investment and management decisions.
(c) In the event that any foreign government-affiliated LP acquires governance rights in Ardent CP III (e.g., through an LP advisory committee seat or similar mechanism), Ardent Capital shall promptly notify the monitoring agency and shall ensure that such LP is excluded from any discussion or decision relating to Luminex US.
F. Reporting and Monitoring Obligations
1. Annual CFIUS Compliance Reports. Luminex US, through the GSO, shall submit annual compliance reports to the designated CFIUS monitoring agency. These reports shall provide a comprehensive accounting of the company's adherence to all mitigation measures set forth in the NSA. At a minimum, the annual report shall cover:
(a) Data security audit results, including findings from the annual third-party cybersecurity audit described in Section IV.B.2;
(b) Personnel clearance status, including any new clearance applications, clearance revocations, and changes in cleared personnel;
(c) GSC meeting minutes (or summaries thereof), documenting the matters reviewed and decisions taken by the Government Security Committee;
(d) Government contract performance summaries, including any contract modifications, renewals, or terminations;
(e) Any security incidents, data breaches, or compliance exceptions that occurred during the reporting period, along with remediation actions taken; and
(f) An updated organizational chart showing the governance structure of Luminex US and its relationship to Apex Holdings, Ardent CP III, and Northvale.
2. Incident Reporting. In addition to annual reporting, the mitigation framework shall include incident reporting obligations requiring immediate notification to the monitoring agency of specified events. We recommend the following notification triggers and timelines:
(a) Within 24 hours: Any confirmed data breach involving government contract data or CUI; any unauthorized access to government contract systems by a non-cleared or non-authorized individual; any attempted intrusion or cyberattack targeting government contract environments.
(b) Within 72 hours: Any security incident involving government contract data or CUI that does not rise to the level of a confirmed breach but warrants investigation; any compliance exception or deviation from NSA requirements identified by the GSO, GSC, or third-party monitor.
(c) Within 30 days: Any material change in the ownership structure of Ardent Apex Holdings Inc. or its parent entities, including any change in the LP composition of Ardent CP III that results in a new foreign-government-affiliated investor acquiring a commitment of more than $50,000,000; any change in the officers or directors of Luminex US; any new subcontractor engagement for government contract work.
3. Third-Party Monitoring. We recommend agreeing to engage a CFIUS-approved third-party monitor to conduct periodic compliance audits for the duration of the mitigation agreement. Third-party monitoring has become a standard feature of NSAs in recent years and provides CFIUS with independent assurance that the mitigation measures are being effectively implemented.
The monitor shall be selected from a list of CFIUS-approved firms and shall have expertise in government security, cybersecurity, and regulatory compliance. The monitor shall conduct semi-annual or annual audits (the frequency to be determined in negotiation with CFIUS), with the scope of each audit to include:
(a) Verification of data segregation and access controls;
(b) Review of network security architecture and zero-trust implementation;
(c) Audit of personnel clearance records and access control lists;
(d) Assessment of GSC governance effectiveness and independence;
(e) Review of Northvale information-access restrictions and compliance;
(f) Evaluation of cross-border data transfer controls; and
(g) Testing of incident-response procedures.
The duration of the third-party monitoring obligation is typically 10 years or the life of the government contracts, whichever is longer. All costs associated with the third-party monitor — including engagement fees, audit expenses, and travel costs — shall be borne by Ardent Apex Holdings Inc. These costs are reflected in the implementation and ongoing cost estimates set forth in Section VI.C below.
V. Coordination with Other Regulatory Filings
A. HSR / FTC Review
The Transaction is subject to pre-merger notification under the Hart-Scott-Rodino Antitrust Improvements Act of 1976, as amended ("HSR Act"). The parties filed their respective HSR notification forms on March 28, 2025 (Transaction No. HSR-20250328-4192). The initial 30-day waiting period under the HSR Act is currently set to expire on April 27, 2025.
Based on preliminary market analysis, the Transaction presents potential competitive concerns in the procurement-automation SaaS market, where Luminex holds an estimated 18% market share. Ardent Capital's existing portfolio includes Vectis Solutions LLC, a competitor in the procurement-automation space with an estimated 7% market share. The combined post-acquisition market share of approximately 25% is above the threshold that typically triggers enhanced FTC scrutiny, and we anticipate that the FTC will issue a Second Request for additional information and documentary material on or about April 25, 2025. The Second Request process could extend the antitrust review by several months.
The FTC antitrust review is legally and procedurally separate from the CFIUS national-security review, but both processes are running in parallel and must be coordinated carefully. In particular:
(a) Any CFIUS-mandated divestiture of the government contract business line of Luminex US would need to be assessed for antitrust implications, as the divestiture of a business line to a competitor could alter the competitive dynamics in the procurement-automation market.
(b) Conversely, if the FTC requires a divestiture remedy to address antitrust concerns (e.g., divestiture of the Vectis Solutions business), the scope of any such divestiture should be coordinated with the CFIUS mitigation framework to ensure that government contract performance and data security are not compromised.
(c) Information provided to the FTC in response to a Second Request may include competitively sensitive data about Luminex US's government contracts; such information should be reviewed for national-security sensitivity before production.
Elaine Forsythe of Calderwood & Harkness's Antitrust & Competition practice group is leading the antitrust strategy for the Transaction. We have established a standing coordination protocol between the CFIUS and antitrust workstreams and recommend maintaining weekly touchpoints between the two teams throughout the parallel review period.
B. EU Foreign Subsidies Regulation
The EU Foreign Subsidies Regulation ("FSR") notification was filed on April 11, 2025 (Case No. FSR.M.2025-0412). The FSR notification was triggered by the presence of sovereign wealth and state-affiliated investors in the Ardent CP III LP base — the same investor profile that generates CFIUS concerns. Under the FSR, the European Commission will assess whether foreign financial contributions (including investments by sovereign wealth funds and state-affiliated entities) confer an advantage that distorts the EU internal market.
While the FSR review focuses on competition and market-distortion concerns rather than national-security concerns, the factual overlap between the FSR and CFIUS filings is significant. Any information provided to the European Commission regarding foreign financial contributions — including the identities of sovereign wealth LPs, the amounts and terms of their commitments, and the governance rights associated with their investments — should be reviewed for consistency with the representations made in the CFIUS filing. Inconsistencies between regulatory filings could undermine credibility with both the European Commission and CFIUS, and should be avoided.
C. Swiss FINMA/SECO and Bundeskartellamt
The Transaction is also subject to regulatory review in Switzerland and Germany, given Luminex's operational presence in both jurisdictions through Luminex AG and Veltronix GmbH, respectively.
The Swiss notification was filed with the Swiss Competition Commission ("COMCO") and coordinated with the State Secretariat for Economic Affairs ("SECO") on April 7, 2025 (File No. 32-0973). The German notification was filed with the Bundeskartellamt (Federal Cartel Office) on April 9, 2025 (File No. B6-34/25). Both filings address merger-control requirements under the respective jurisdictions' competition laws.
These foreign regulatory processes may generate questions from Swiss or German authorities about Luminex US's U.S. government contract exposure, particularly if the authorities seek to understand the full scope of the acquired business. Responses to such inquiries should be coordinated with CFIUS counsel (this firm) and the applicable local counsel: