1032-00004 · Client 1032 · CFIUS Strategy & Analysis

cfius-risk-assessment-mitigation-strategy.docx DOCUMENT M&A / Corporate

2 / 79 ← → ✕

CALDERWOOD & HARKNESS LLP

1750 K Street NW, Suite 800, Washington, DC 20006 399 Park Avenue, 31st Floor, New York, NY 10022

PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT PREPARED IN ANTICIPATION OF LITIGATION AND REGULATORY PROCEEDINGS

M E M O R A N D U M

This memorandum is a confidential attorney-client communication and attorney work product prepared by Calderwood & Harkness LLP at the direction of the Vorstand of Halcyon Semiconductor AG for the sole purpose of providing legal advice concerning the pending Committee on Foreign Investment in the United States (CFIUS) review of the transaction described herein. This memorandum may not be reproduced, forwarded, quoted from, or disclosed to any person outside the addressed recipients (and their duly authorized advisors bound by comparable duties of confidentiality) without the prior written consent of the undersigned. Inadvertent disclosure is not intended as a waiver of privilege.

I. Executive Summary

The purpose of this memorandum is to provide the Vorstand of Halcyon Semiconductor AG ("HSAG") with a comprehensive risk assessment of the national security concerns likely to be raised by the Committee on Foreign Investment in the United States ("CFIUS" or the "Committee") in connection with HSAG's proposed acquisition of 100% of the outstanding equity of Marlowe Asset Management Photonics Inc. ("VPI"), and to set forth Calderwood & Harkness's recommended mitigation strategy and initial negotiation positions for the National Security Agreement ("NSA") that we expect will be a condition to clearance. The transaction is being effected pursuant to the Stock Purchase Agreement executed June 10, 2023 (the "SPA"), for aggregate base consideration of $1.42 billion, all cash, on a cash-free, debt-free basis.

Transaction Structure. Halcyon US Holdings Inc., a Delaware C-corporation formed June 5, 2023 as the direct acquisition vehicle ("AcquisitionCo"), will acquire all issued and outstanding shares of VPI at closing. Base purchase price is $1,420,000,000, subject to a customary net working capital true-up. The SPA also provides for a two-tranche earnout of up to $85,000,000 (a $50 million tranche keyed to CY2024 EBITDA and product-qualification milestones and a $35 million tranche keyed to CY2025 revenue thresholds), yielding maximum aggregate consideration of $1,505,000,000.

Financing. The transaction is financed by (i) a $900 million senior secured term loan (Meridian National Bank, administrative agent; Atlas Commercial Lending AG and Pacific Basin Credit Corp., co-lead arrangers; SOFR + 275 bps, five-year tenor, 1% annual amortization with bullet at maturity), and (ii) an HSAG equity contribution of $520 million funded from balance sheet cash and a €300 million draw on HSAG's existing revolving credit facility with Rheinische Handelsbank AG. The debt commitment papers do not contain a CFIUS-related MAC carveout, which we regard as a favorable feature but which also means that Committee-driven delay will directly consume ticking-fee capacity under the commitment letter (see Section VIII).

Filing Type. We recommend, and HSAG has authorized, the filing of a voluntary joint notice under 31 C.F.R. § 800.501. Although a mandatory declaration is required under 31 C.F.R. § 800.401 by virtue of VPI's status as a TID U.S. business dealing in "critical technologies" (as discussed in Section III and analyzed in detail in our separate Mandatory vs. Voluntary Filing Analysis Memorandum dated June 22, 2023), a full voluntary joint notice is decisively preferable given the sensitivity of VPI's classified programs, the near-certainty of second-stage investigation, and the necessity of negotiating a bespoke NSA. Target filing date is July 14, 2023. Pre-filing consultation with the Treasury Office of Investment Security ("OIS") was held on June 19, 2023 (see Appendix B).

Structure of the Analysis. This memorandum identifies seven distinct national security risk factors, assesses the severity of each on a High / Medium-High / Medium scale, proposes a comprehensive mitigation framework, and outlines opening negotiation positions and red lines for the anticipated NSA. A consolidated risk-mitigation matrix appears at Section VII.

Overall Assessment. In our considered judgment, CFIUS clearance is achievable, but the transaction will almost certainly proceed through both a full 45-day review and a 45-day investigation, with clearance conditioned upon the execution of a robust NSA that will impose ongoing compliance, monitoring, and reporting obligations on HSAG and VPI for the foreseeable future. Approval on an unmitigated basis is, in our view, not a realistic outcome. Withdrawal-and-refile is a contingency but should not be assumed as the base case.

Anticipated Lead Agencies. Based on VPI's contract portfolio and technology profile, we expect the Department of Defense ("DoD") to serve as the co-lead review agency, with the Department of Energy ("DOE") likely serving as co-lead in light of the dual-use implications of GaN power electronics for national laboratory and directed-energy programs. The Defense Counterintelligence and Security Agency ("DCSA") is expected to serve as the primary monitoring agency under any resulting NSA.

II. Background: The Target and the Transaction

A. Marlowe Asset Management Photonics Inc. — Business Overview

VPI is a Delaware C-corporation, incorporated February 14, 2009, with principal executive offices at 7400 Ridgeline Parkway, Colorado Springs, CO 80919. Its core business consists of the design and manufacture of advanced gallium-nitride ("GaN") power amplifier chips for defense radar, satellite communications, and 5G infrastructure applications. VPI's manufacturing operations are concentrated at a purpose-built GaN-on-SiC fabrication facility located at 9200 Innovation Boulevard, Albuquerque, NM 87113 (the "Albuquerque Fab"), a 45,000 square-foot facility operating under a DCSA-issued Facility Security Clearance ("FCL") at the SECRET level and identified by CAGE Code 7VK92.

Reported financials for FY2022 are as follows: revenue of $287.4 million; EBITDA of $61.2 million. VPI employs 486 persons on a full-time-equivalent basis, of whom 212 hold active U.S. government personnel security clearances (representing 43.6% of the workforce)—an unusually high cleared-personnel concentration that reflects the classified nature of much of VPI's revenue base.

Key management personnel are as follows:

• Dr. Nathan Trevorrow — CEO and founder; TS/SCI clearance; former DARPA program manager (Microsystems Technology Office).

• Marissa Sung-Avila — President and COO; SECRET clearance; former U.S. Army signal corps officer.

• Col. (Ret.) Bryce Hendrickson, USAF — Vice President, Government Programs, and Facility Security Officer ("FSO"); TS/SCI clearance.

• Derek Wainsborough — CFO; no clearance.

B. VPI Government Contracts and Classified Programs

VPI performs under 14 active DoD prime and subcontract vehicles with an aggregate remaining backlog of approximately $193 million. The five largest by remaining backlog are:

Contracting agencies across the portfolio include U.S. Army PEO IEW&S, the Air Force Research Laboratory (AFRL), the Missile Defense Agency (MDA), NAVSEA (via Ironclad Defense Systems Inc.), and DHS Science & Technology Directorate. A complete contract-level schedule, including performance periods and classification levels, appears at Appendix C.

C. VPI Export Controls and ITAR/EAR Profile

VPI has been registered with the Directorate of Defense Trade Controls ("DDTC") since 2011 under Registration No. M-24817. Certain VPI products constitute defense articles under ITAR Category XI(a)(3) (military electronics — specifically, components for military radar and electronic warfare). Additional dual-use products are classified under the Export Administration Regulations at ECCNs 3A001 (electronic items), 3A991, and 3E001 (associated technology). VPI currently holds three active DSP-5 permanent export licenses authorizing deliveries to NATO allies (specifically, the United Kingdom and Australia). A detailed export-controlled items listing appears at Appendix D.

D. VPI Intellectual Property

VPI's IP portfolio comprises 47 granted U.S. patents and 12 pending U.S. patent applications, organized into three principal patent families: (i) GaN-on-SiC epitaxial growth (8 patents); (ii) HEMT gate structure optimization (19 patents); and (iii) mmWave broadband matching network (20 patents). VPI has separately identified and internally registered 31 categories of trade secrets, principally proprietary GaN epitaxial recipes and die-level reliability screening protocols developed at the Albuquerque Fab.

Of particular importance for CFIUS purposes, 23 of the 47 granted patents were developed under U.S. government-funded contracts and are subject to march-in rights under 35 U.S.C. § 203 and to the government-purpose license and rights-in-data provisions of DFARS 252.227-7038. These patents cannot be assigned, exclusively licensed, or otherwise transferred out of U.S.-owned control without careful navigation of Bayh-Dole and DFARS requirements.

E. Halcyon Semiconductor AG — Acquiror Profile

HSAG is a publicly traded German Aktiengesellschaft with shares listed on the Frankfurt Stock Exchange (XETRA: HLC). Market capitalization as of June 1, 2023 was approximately €14.8 billion. HSAG is headquartered at Industriestraße 44, 01099 Dresden, Saxony, Germany, and is registered with the Amtsgericht Dresden under HRB 28416 (LEI: 5299007KXQ2M4GHILZ38). Reported FY2022 revenue was €6.12 billion; EBITDA was €1.37 billion.

HSAG's existing U.S. footprint is limited to Halcyon US Inc., a fabless design center at 11501 Alterra Parkway, Suite 300, Austin, TX 78758, employing approximately 320 persons. Halcyon US Inc. performs no classified work and holds no FCL.

Key HSAG management personnel are Dr. Maximilian Ehrhardt (CEO, German citizen, no U.S. clearance); Katarina Brückner (CFO, German citizen, no U.S. clearance); and Stefan Lohse (General Counsel, dual German/U.S. citizen, admitted to the New York bar, Georgetown LL.M., no U.S. clearance). Our due diligence has identified no German government ownership, veto rights, golden shares, or comparable state influence over HSAG. HSAG is not on any BIS Entity List, SDN List, or comparable restriction list.

HSAG operates a Chinese subsidiary, Halcyon Semiconductor (Shanghai) Co., Ltd., which recorded FY2022 revenue of approximately $81.4 million (approximately 1.3% of HSAG consolidated revenue). Shanghai operations are limited to consumer-grade power management integrated circuits; the subsidiary conducts no GaN, RF, defense, or dual-use activities. Notwithstanding the limited scope of the Shanghai operations, we anticipate that the mere existence of a China subsidiary will attract Committee scrutiny (see Risk Factors 2, 4, and 5 below).

F. Existing VPI Shareholders

The pre-closing capitalization of VPI is as follows:

We have confirmed with seller's counsel that Ridgecrest Ventures Fund III and Cascadian Capital Partners Growth Fund II have no foreign limited partners with individual interests exceeding 10%, and neither fund has foreign-government limited partners. This confirmation will be documented in the notice.

G. Transaction Valuation Context

Enterprise value at closing is $1.42 billion, implying multiples of approximately 4.94x LTM revenue and 23.2x LTM EBITDA—multiples consistent with recent defense-adjacent semiconductor precedent transactions. Consideration is 100% cash at closing.

A closing escrow holdback of $71,000,000 (5% of base purchase price) will be held for 18 months by Pinnacle Trust Company, N.A. (Chicago) as escrow agent. Representations and warranties insurance has been bound with Graystone Specialty Insurance Company (Policy No. GSI-RW-2023-04821): policy limit $142,000,000 (10% of purchase price); retention $14,200,000 (1%); premium $4,970,000 (3.5% of policy limit). The R&W policy contains a customary carve-out for CFIUS/national security matters known at binding; we have negotiated the carve-out narrowly and it does not exclude the general categories of representations relevant here.

III. CFIUS Jurisdictional Basis and Expected Review Process

The transaction is a "covered transaction" under 31 C.F.R. § 800.213 because it involves a foreign person (HSAG, a German AG, acting through AcquisitionCo) acquiring "control" (in fact, 100% ownership) of a U.S. business (VPI). No jurisdictional argument is available to HSAG that would place the transaction outside CFIUS's reach, and none should be attempted; the strategic posture is one of full and proactive engagement.

VPI qualifies as a "TID U.S. business" within the meaning of 31 C.F.R. § 800.248 for at least two independent reasons: (i) VPI produces items classified under ECCN 3A001 (dual-use GaN semiconductors) and ITAR Category XI(a)(3) (defense articles), each of which is a "critical technology" within the meaning of § 800.215; and (ii) export of those items to HSAG's home jurisdiction (Germany) requires U.S. regulatory authorization from DDTC and/or BIS.

Because both prongs of the § 800.401 mandatory declaration test are met, a mandatory filing obligation attaches. As set forth in our June 22, 2023 Mandatory vs. Voluntary Filing Analysis Memorandum, however, we strongly recommend—and HSAG has authorized—the filing of a full voluntary joint notice under 31 C.F.R. § 800.501 in lieu of a short-form declaration. The declaration procedure is ill-suited to a transaction of this complexity and sensitivity; the Committee would almost certainly request a full notice at the conclusion of the 30-day declaration assessment period, resulting in delay without commensurate benefit.

The expected process is as follows:

1. Pre-filing consultation (completed June 19, 2023 with Treasury OIS).

2. Draft notice submission (early July 2023) for informal Committee comment.

3. Formal filing of the joint voluntary notice (target: July 14, 2023).

4. Acceptance by CFIUS staff following review for completeness (typically 5–7 business days).

5. 45-day review period commencing on the acceptance date.

6. 45-day investigation period, which we regard as essentially certain given the classified programs, ITAR-controlled technology, and cleared personnel involved.

7. Mitigation negotiation in parallel with the investigation, followed by NSA execution and clearance.

We expect DoD and DOE to serve as co-lead agencies. DCSA will be the operational monitoring agency post-clearance and will be a substantive participant in NSA negotiation, particularly on FOCI mitigation elements. Other agencies expected to participate substantively include Commerce (BIS), State (DDTC), Justice (National Security Division), and the Intelligence Community assessment element (ODNI).

Pre-Filing Consultation Feedback. In the June 19, 2023 pre-filing meeting, Treasury OIS staff (Marta Chen, Deputy Director; Robert Feldman, Senior Case Officer) identified three preliminary areas of focus: (i) HSAG's China operations, particularly the Shanghai subsidiary, and the sufficiency of controls preventing any downstream technology or personnel flow from VPI to Chinese entities; (ii) HSAG's cybersecurity posture and the specific plan for IT segregation between VPI and HSAG's global network; and (iii) the post-closing governance architecture for VPI, and specifically whether HSAG intends to propose an SSA-equivalent NSA. Staff did not identify any preliminary "showstoppers." A more complete summary appears at Appendix B.

IV. National Security Risk Factor Analysis

We have identified seven principal national security risk factors, analyzed below. Each analysis addresses (A) the nature of the risk, (B) our severity assessment, and (C) our proposed mitigation approach.

Risk Factor 1: Foreign Access to Classified Defense Programs

A. Description of Risk. VPI holds an FCL at the SECRET level at the Albuquerque Fab (CAGE Code 7VK92). Of the 486 total VPI employees, 212 (43.6%) hold active U.S. government personnel security clearances at either the SECRET or TS/SCI level. Col. (Ret.) Bryce Hendrickson, USAF (TS/SCI) serves as the FSO of record. VPI performs on multiple classified programs, including work under Army, AFRL, and MDA contracts, and, through its subcontract with Ironclad Defense Systems Inc., contributes to NAVSEA classified naval programs.

Post-acquisition, HSAG—as a foreign entity—would hold indirect ownership of, and would in the absence of mitigation exert influence over, a cleared contractor facility and a substantial cleared workforce. The Committee's baseline concern is straightforward and paramount: unauthorized foreign access to classified national defense information, whether by design or by ordinary integration processes, and the associated espionage and counterintelligence risk.

B. Severity Assessment. HIGH. The classified programs are the single most sensitive element of the transaction. Any perception—whether well-founded or not—that HSAG or any HSAG affiliate could obtain access to classified information would be effectively disqualifying. CFIUS precedent in analogous transactions (see the comparative NSA analysis at Appendix E) uniformly requires SSA-equivalent FOCI mitigation for any foreign acquisition of a cleared contractor.

Germany's status as a NATO ally with a mature bilateral General Security of Military Information Agreement (GSOMIA) and deep intelligence-sharing relationships is a contextual mitigant but does not obviate the need for formal mitigation. NISPOM does not permit FCL retention under foreign ownership without an approved mitigation instrument, allied nationality notwithstanding.

C. Proposed Mitigation.

• The NSA to be structured as a Special Security Agreement ("SSA") equivalent under NISPOM (32 C.F.R. Part 117).

• Reconstitution of the VPI board to include a majority of "Security Board Members" who are U.S. citizens holding or eligible for TS/SCI clearances, with exclusive authority over classified programs and personnel security matters.

• Establishment of a Government Security Committee ("GSC") composed solely of Security Board Members and reporting to DCSA.

• Col. (Ret.) Hendrickson to be retained as FSO, reporting directly to the GSC.

• HSAG-designated directors to be absolutely prohibited from accessing classified information; they will be provided with sanitized summaries of GSC activities only.

• Physical access restrictions: HSAG personnel excluded from the classified areas of the Albuquerque Fab—specifically clean-room Sections C-7 through C-12—without prior written approval of both DCSA and the GSC on a per-visit basis.

Risk Factor 2: Transfer of ITAR/EAR-Controlled Technology to Non-U.S. Persons

A. Description of Risk. VPI's product portfolio includes ITAR Category XI(a)(3) defense articles and EAR-controlled items under ECCNs 3A001, 3A991, and 3E001 (the last of which covers associated technology and constitutes a particularly acute deemed-export concern). VPI's DDTC registration (M-24817) and three active DSP-5 export licenses further evidence the export-controlled character of its output.

Post-closing, in the ordinary course of parent-subsidiary integration—financial reporting, engineering collaboration, product roadmap alignment, cross-hire, joint procurement—HSAG personnel who are German or other non-U.S. nationals could request or inadvertently receive access to controlled technical data. Any such transfer would constitute a "deemed export" or "deemed re-export" and, if unauthorized, would violate the Arms Export Control Act (22 U.S.C. § 2778), the ITAR (22 C.F.R. Parts 120–130), the Export Control Reform Act (50 U.S.C. § 4801 et seq.), and/or the EAR (15 C.F.R. Parts 730–774). Consequences range from administrative debarment to criminal exposure.

The Committee's concern extends beyond intentional misconduct to structural risk—that post-closing integration will, over time, erode the technical and organizational separation between VPI's controlled technology base and HSAG's global operations (Germany, Austin, and, most sensitively, Shanghai).

B. Severity Assessment. HIGH. ITAR/EAR technology-transfer risk is consistently the most heavily litigated mitigation subject in semiconductor-sector CFIUS transactions. The dual ITAR/EAR character of VPI's product line creates multiple vectors for unauthorized transfer. HSAG's Shanghai subsidiary—while small, commercially remote from VPI's product line, and confined to consumer-grade power ICs—will nevertheless draw scrutiny as a hypothetical secondary transfer node, and the Committee will require affirmative structural assurance that Shanghai is walled off from VPI in perpetuity.

C. Proposed Mitigation.

• Adoption of a formal, written Technology Control Plan ("TCP") governing access to, use of, and transfer of all VPI technical data and technology, annexed to and enforceable under the NSA.

• Absolute prohibition on the transfer of any ITAR- or EAR-controlled technical data to any non-U.S. person absent prior U.S. government authorization (DDTC license, BIS license, deemed-export license, or applicable exemption).

• Organizational, physical, and IT segregation of VPI's export-controlled R&D and manufacturing from HSAG's global operations, with a hard prohibition on any technology sharing between VPI and Halcyon Semiconductor (Shanghai) Co., Ltd.

• Pre-authorization protocol for all cross-border technology sharing: GSC approval plus, where applicable, DDTC or BIS licensure obtained in advance.

• Mandatory export-controls training for all VPI and relevant HSAG personnel, with annual refresher and per-hire onboarding.

• Annual TCP compliance audits by the third-party monitor (see Section V.E).

Risk Factor 3: Supply Chain Disruption and Critical Defense Supply Continuity

A. Description of Risk. VPI is a key supplier of GaN power amplifier components to several critical DoD modernization programs, including the AN/TPS-80 radar (Army), next-generation mmWave amplifier programs (AFRL), T/R modules for missile defense architectures (MDA), and naval RF systems (via Ironclad Defense Systems Inc. to NAVSEA). VPI's aggregate backlog across 14 active contracts totals $193 million, and for several product lines VPI is, if not formally sole-source, then functionally so given the proprietary GaN-on-SiC epitaxial recipes and program-specific qualifications.

Change-of-ownership events—even benign ones—create disruption risk in three dimensions: (i) contract performance interruption during novation and re-qualification; (ii) contracting officer discomfort with foreign ownership, potentially manifesting as delayed novation, reduced follow-on procurement, or (in the worst case) reprocurement to a domestic source; and (iii) counterparty confidence erosion among program offices and prime contractors.

B. Severity Assessment. HIGH. GaN power amplifiers are essential to multiple DoD modernization programs; VPI occupies a strategically significant node in the domestic defense industrial base. The products are difficult to second-source in the short term. Novation under FAR Subpart 42.12 requires affirmative contracting officer approval on a contract-by-contract basis and may face resistance if CFIUS concerns are not visibly addressed.

C. Proposed Mitigation.

• NSA commitment to maintain VPI's U.S.-based manufacturing operations at the Albuquerque Fab for a minimum period. Proposed opening position: five years, with automatic annual renewal thereafter subject to notice.

• No relocation of manufacturing or production lines outside the United States absent prior CFIUS notification and, for cleared or export-controlled lines, approval.

• Personnel-continuity provisions: retention of Dr. Trevorrow, Ms. Sung-Avila, and Col. Hendrickson for a minimum of 24 months post-closing; replacements subject to GSC and DCSA approval.

• 30-day pre-notification to CFIUS before any material change to VPI's business, including divestitures, material foreign subcontracts, or changes to cleared personnel.

• Affirmative commitment to support the FAR 42.12 novation process for all 14 active government contracts. Our contracts team has identified 8 contracts likely requiring formal novation agreements and 6 that we assess can proceed by change-of-name agreement or contract-level notification alone.

• Maintenance of VPI as a separately managed U.S. subsidiary with independent contracting authority, its own certifications and representations, and its own supply-chain risk management program.

Risk Factor 4: Cybersecurity Risks from Foreign IT Integration

A. Description of Risk. Any post-closing integration of VPI's IT environment with HSAG's global corporate network would create pathways—intentional or not—for unauthorized access to controlled technical data, classified program information, and proprietary trade secrets. HSAG operates a global IT infrastructure spanning Germany, China (Shanghai), and the U.S. (Austin). VPI's current IT environment supports both classified and unclassified operations and is subject to, among other things, the security-control requirements of NIST SP 800-171 (as incorporated by DFARS 252.204-7012) and, for classified information systems, DCSA-authorized configurations under NISPOM.

CFIUS's cybersecurity concerns encompass both direct integration (shared identity providers, shared cloud tenancy, shared endpoint management) and indirect exposure (VPI reliance on HSAG-managed services, or the introduction of HSAG-based cyber threat exposure into VPI's environment).

B. Severity Assessment. MEDIUM-HIGH. Cybersecurity has emerged as one of the most heavily scrutinized subject areas in CFIUS reviews since the SolarWinds and Microsoft Exchange incidents of 2020–2021. Treasury flagged cybersecurity specifically at the June 19 pre-filing meeting. HSAG's ISO 27001 certification is a favorable baseline, but it is not sufficient by itself to address the specific concerns raised by a cleared defense contractor acquisition.

C. Proposed Mitigation.

• Full physical and logical segregation of VPI IT systems from the HSAG global network. No shared identity provider, no shared endpoint management, no shared cloud tenancy.

• VPI to maintain NIST SP 800-171 compliance on an independent basis; VPI's SPRS score to be maintained at or above current baseline.

• Annual third-party penetration testing of VPI IT systems by a monitor-approved firm.

• Cybersecurity incident reporting to DCSA within 72 hours of discovery of any reportable event.

• HSAG IT personnel prohibited from accessing or administering VPI systems absent prior GSC approval and, where applicable, U.S. person status verification.

• VPI to maintain a dedicated cybersecurity staff (proposed: minimum 6 FTEs including CISO) reporting into the GSC.

• Incident response plan and continuity-of-operations plan to be reviewed and approved by DCSA and refreshed annually.

Risk Factor 5: Foreign Ownership, Control, or Influence (FOCI)

A. Description of Risk. HSAG's 100% acquisition of VPI equity creates direct foreign ownership of a cleared contractor. Under NISPOM, foreign ownership, control, or influence ("FOCI") over a cleared entity must be mitigated to a level acceptable to DCSA in order to retain the FCL. In assessing FOCI, the Committee and DCSA will examine, among other factors: (i) whether any foreign government exercises direct or indirect influence over HSAG (via ownership, veto, board rights, industrial policy leverage, or otherwise); (ii) HSAG's board composition and shareholder base; (iii) HSAG's relationships with non-allied governments; and (iv) HSAG's operations in jurisdictions of concern, principally the PRC.

B. Severity Assessment. MEDIUM. Germany is a NATO ally with established intelligence-sharing arrangements. No German government ownership of HSAG has been identified; HSAG's largest shareholders are institutional asset managers with fiduciary rather than strategic postures. HSAG's Shanghai subsidiary is the principal contextual concern, but its scale (approximately 1.3% of consolidated revenue) and commercial character (consumer-grade PMICs) render it a manageable rather than disqualifying element.

C. Proposed Mitigation.

• NSA to function as the FOCI mitigation instrument, structured as an SSA equivalent under NISPOM.

• Board restructuring (see Risk Factor 1) placing a majority of Security Board Members with clearances on the VPI board.

• GSC exclusive authority over classified and ITAR-controlled programs, insulating those matters from any HSAG influence.

• HSAG to provide annual certifications regarding (i) its ownership structure (including any threshold changes in beneficial ownership), (ii) any government relationships or ownership stakes exceeding a de minimis threshold, and (iii) material changes to Halcyon Semiconductor (Shanghai) Co., Ltd.'s operations, ownership, or product scope.

• VPI to maintain separate corporate governance, financial reporting (with appropriate consolidation carve-outs for classified matters), and contracting authority from HSAG global operations.

Risk Factor 6: Continuity of Cleared Personnel and Key Employees

A. Description of Risk. The 212 cleared employees represent both a compliance asset and a security-sensitive population. The three key personnel—Dr. Trevorrow, Ms. Sung-Avila, and Col. Hendrickson—are critical to VPI's classified program performance, its customer relationships, and its FCL maintenance. Change-of-control transactions frequently produce personnel attrition; unmanaged attrition of cleared personnel would impair contract performance and potentially trigger FCL review. Loss of Col. Hendrickson as FSO would trigger DCSA notification requirements and, absent an approved successor, potential FCL suspension.

B. Severity Assessment. MEDIUM-HIGH. Personnel continuity is both a security concern and a practical concern for program performance. CFIUS has, with increasing frequency, required specific personnel-retention provisions in NSAs for cleared contractor transactions since approximately 2020.

C. Proposed Mitigation.

• NSA to require that Dr. Trevorrow, Ms. Sung-Avila, and Col. Hendrickson each remain employed by VPI for a minimum of 24 months post-closing.

• Any departure or replacement of these key personnel to be subject to GSC review and DCSA notification (and, in the case of the FSO, DCSA approval of successor).

• The FSO role to be specifically identified in the NSA, with a written succession plan approved by DCSA.

• HSAG to commit contractually to maintaining competitive compensation, benefits, and retention economics for cleared VPI employees, and to a "no material adverse change" standard for cleared-employee compensation and benefits during the retention period.

• 30-day pre-notification to CFIUS of any material changes to cleared personnel (departures, key new hires, clearance terminations, adverse security actions).

Risk Factor 7: Government Contract Continuity and Regulatory Compliance

A. Description of Risk. The transaction triggers a cascading set of regulatory notification and consent requirements independent of CFIUS itself:

• Each of VPI's 14 active contracts requires either novation or change-of-name treatment under FAR Subpart 42.12.

• The change in ownership triggers foreign-ownership disclosure under DFARS 252.209-7002.

• VPI's DDTC registration (M-24817) requires notification of change of ownership under ITAR § 122.4(a) within 60 days.

• Each of the 3 active DSP-5 export licenses requires amendment to reflect the new ownership structure.

• BIS notification may be required with respect to certain ECCN 3E001 technology holdings.

Failure to comply timely with any of these obligations carries significant collateral consequences: contract termination, stop-work orders, ITAR administrative debarment, license invalidation, and civil or criminal penalties.

B. Severity Assessment. MEDIUM. These are largely procedural and administrable requirements, but the aggregate compliance burden is substantial and the cost of any single misstep is high. The FAR 42.12 novation process for the 8 novation-required contracts is expected to require six to twelve months and to demand contracting-officer engagement on a per-contract basis.

C. Proposed Mitigation.

• NSA commitment to prompt compliance with all FAR 42.12 novation obligations, with a targeted completion window.

• VPI to file DFARS 252.209-7002 foreign-ownership disclosures with each cognizant contracting officer within the required timeframe post-closing.

• Filing of the ITAR § 122.4(a) DDTC change-of-ownership notification promptly post-closing.

• Amendment filings for all three active DSP-5 licenses.

• Continuity of existing contracting relationships and points of contact through the novation transition, with early contracting-officer outreach led by Col. Hendrickson (or successor FSO) beginning within 10 business days of CFIUS clearance.

V. Comprehensive Mitigation Framework

The following framework consolidates and structures the mitigation measures proposed in Section IV into a coherent NSA architecture. This framework should be understood as our recommended opening position; specific terms will be refined during NSA negotiation with the co-lead agencies.

A. Board Restructuring and Corporate Governance

We recommend a five-member reconstituted VPI board, comprising:

• Three Security Board Members — U.S. citizens holding or eligible for TS/SCI clearances. At least one Security Board Member to be an "Independent Security Director" appointed with CFIUS approval and with no prior or ongoing commercial relationship with either HSAG or VPI.

• Two HSAG designees — persons designated by HSAG for oversight of commercial operations. HSAG designees may not access classified information under any circumstances and will receive sanitized summaries only of GSC-privileged matters.

Our proposed Security Board Members are: (i) Col. (Ret.) Bryce Hendrickson (TS/SCI); (ii) Adrienne Delacroix, currently an independent director of VPI (SECRET clearance, cleared for expedited upgrade); and (iii) an Independent Security Director to be identified during NSA negotiation. We have preliminarily identified three candidates for the Independent Security Director role and will circulate biographical materials under separate cover for the Vorstand's consideration prior to formal proposal to CFIUS.

HSAG's two designees are, in the base case, expected to be Dr. Ehrhardt (or his delegate) and one further nominee to be determined, focused on commercial oversight and integration.

The Government Security Committee ("GSC") will be composed exclusively of the three Security Board Members and will have exclusive board-level authority over: classified programs; ITAR-controlled activities; personnel security matters; facility security; and all matters of NSA compliance. All other matters (commercial strategy, budgets, non-classified capital expenditure, non-cleared executive compensation, dividend policy) remain within the authority of the full board.

B. Technology Control Plan (TCP)

The TCP will be a formal, written plan annexed to the NSA and independently enforceable under it. Its principal elements are:

1. An absolute prohibition on the transfer of ITAR- or EAR-controlled technical data to any non-U.S. person absent prior U.S. government authorization or applicable exemption.

2. Detailed procedures identifying categories of information that may permissibly flow between VPI and HSAG (financial reporting data, aggregated operational metrics, non-controlled commercial data, publicly available product information), with clearly delineated escalation and approval workflows.

3. Physical and procedural access controls at VPI facilities, including the classified-area exclusion zones.

4. Recordkeeping and audit requirements sufficient to permit meaningful monitor and DCSA review.

5. Personnel training obligations, both role-based and general.

C. Facility Access Restrictions

HSAG personnel who are not U.S. persons are prohibited from accessing the classified areas of the Albuquerque Fab (specifically, clean-room Sections C-7 through C-12) except with prior written approval from both DCSA and the GSC on a per-visit basis. Access to unclassified areas is permitted subject to advance notice, escort by a cleared VPI employee, and standard visitor logging and prohibited-items protocols. A detailed access procedures annex will be attached to the NSA.

D. IT and Data Segregation

VPI's IT systems will be physically and logically separated from HSAG's global network. This means: no shared identity provider; no shared cloud tenancy; no shared endpoint management; no shared VPN infrastructure; and no shared help-desk or SOC operations. VPI will maintain NIST SP 800-171 compliance independently and will submit its own SPRS score. Third-party penetration testing will be conducted annually. Incident reporting to DCSA is required within 72 hours. VPI will maintain a dedicated cybersecurity staff of at least six FTEs reporting to the GSC through the CISO.

E. Third-Party Compliance Monitor

An independent third-party monitor with TS/SCI clearance will conduct annual compliance audits and report to CFIUS monitoring agencies. Our recommended candidate is:

• Whitmore Compliance Group LLC — Principal: Gerald Whitmore (former FBI Counterintelligence Division; active TS/SCI clearance; approximately 22 years of federal service). Offices: 1300 Crystal Drive, Suite 710, Arlington, VA 22202.

Whitmore Compliance Group has served as monitor on eight comparable semiconductor-sector NSAs since 2019 and is well-known to DCSA and Treasury OIS staff. Monitor scope will include annual audits covering all NSA compliance areas (board governance, TCP compliance, cybersecurity, facility access, data segregation, personnel continuity) plus ad hoc reviews upon incident or Committee request.

Cost will be borne by HSAG. Based on benchmarking against comparable semiconductor-sector monitor engagements, we anticipate an annual fee in the range of $1.0 million to $1.5 million, payable quarterly, subject to reasonable expense reimbursement. The monitor must be formally approved by CFIUS during NSA negotiation.

F. Personnel Continuity

Dr. Trevorrow, Ms. Sung-Avila, and Col. Hendrickson to remain employed for a minimum of 24 months post-closing, with departures or replacements subject to GSC review and DCSA notification (and, for the FSO role, DCSA approval). FSO succession plan to be filed with DCSA within 60 days of closing. HSAG to commit to competitive compensation and benefits for cleared VPI employees generally.

G. Pre-Notification of Material Changes

30-day advance notification to CFIUS required for any material change to VPI's business, including divestitures, material foreign subcontracts, changes to cleared personnel, material changes to manufacturing operations, and changes to VPI's product line requiring new ITAR or EAR classifications. Annual compliance reports to the co-lead agencies. Annual certifications from HSAG regarding ownership structure and foreign government relationships.

H. Penalty and Enforcement Provisions

The standard NSA penalty framework provides for civil penalties up to $250,000 per violation per day, injunctive relief, and, in the most serious cases, mandated divestiture. Our negotiation objectives with respect to this framework are: (i) proportionality between severity and remedy; (ii) meaningful cure periods for inadvertent, non-material violations; (iii) clear definition of what constitutes a "violation" and specifically the exclusion of immaterial administrative oversights; and (iv) express recognition that divestiture is a remedy of last resort available only for material, uncured violations of core provisions.

VI. Initial Negotiation Positions for NSA Terms

The following sets forth our recommended opening positions, red lines, and anticipated Committee positions for each principal NSA term. These positions should be understood as opening postures, subject to iteration and refinement during negotiation.

A. Board Composition and Governance

HSAG Position (Opening). Accept a five-member board consisting of three Security Board Members and two HSAG designees. Preserve full-board authority over non-classified, non-ITAR commercial matters, including budgets, non-classified capital expenditure, commercial strategy, and executive compensation for non-cleared roles.

HSAG Red Line. HSAG must retain meaningful board representation and commercial governance authority. GSC authority should be strictly limited to classified/controlled programs and security matters and should not migrate into broader commercial or technology decision-making.

Anticipated CFIUS Position. Broad GSC authority, potentially extending to any technology-related decision (including commercial R&D) and to key hiring/firing beyond the security-clearance-holding population. We should resist migration of GSC authority into commercial matters and preserve a bright line between security and commercial governance.

B. TCP Scope

HSAG Position (Opening). TCP scope narrowly tailored to ITAR/EAR-controlled technical data. Commercial, non-controlled information (financial reporting, aggregated operational metrics, publicly available product information) to flow freely between VPI and HSAG in the ordinary course.

HSAG Red Line. HSAG must be able to receive non-controlled financial, operational, and commercial data sufficient to satisfy IFRS consolidation, public-disclosure obligations under German securities laws, and ordinary parent-company reporting.

Anticipated CFIUS Position. Expansive TCP potentially covering all "technical data" without regard to control status. Negotiate for clear categorical carve-outs and a rules-based rather than approval-based information flow regime for non-controlled data.

C. Monitor Scope and Independence

HSAG Position (Opening). Monitor scope limited to verifying NSA compliance. No operational authority over VPI. No veto power over VPI business decisions. Annual audit framework with ad hoc reviews only upon reasonable cause.

HSAG Red Line. The monitor is an auditor, not a manager. Monitor costs must be reasonable and benchmarked against comparable engagements. The monitor should not be empowered to expand its own scope unilaterally.

Anticipated CFIUS Position. Broad monitor authority with real-time access, potentially including on-site presence and continuous data feeds. We should push firmly for a defined annual audit framework with ad hoc reviews confined to reasonable-cause triggers.

D. Cost Allocation

HSAG Position (Opening). HSAG bears monitor costs as part of the cost of acquisition. Annual fee cap, with CPI-only escalation.

Anticipated Range. $1.0 million to $1.5 million per annum, based on comparable semiconductor-sector NSA engagements (see Appendix E).

HSAG Red Line. No open-ended cost obligations. Government agencies must not have unilateral authority to expand monitor scope (and cost) without consultation. Ad hoc reviews to be capped or scope-defined in advance.

E. Personnel Continuity

HSAG Position (Opening). Accept 24-month retention commitment for the three key personnel (Trevorrow, Sung-Avila, Hendrickson). Voluntary resignations to be excluded from the retention obligation, provided (i) the resignation is genuinely voluntary and not induced by HSAG action; (ii) HSAG promptly identifies a qualified replacement; and (iii) the replacement is approved by the GSC and, for the FSO role, by DCSA.

Anticipated CFIUS Position. Strict retention obligation with penalties for any departure regardless of cause. Negotiate for a clear distinction between voluntary resignations and involuntary terminations, with penalties confined to the latter.

F. Cybersecurity. HSAG Position (Opening). NIST SP 800-171 (with DFARS 252.204-7012 implementation) is the appropriate baseline standard, consistent with VPI's existing government contract obligations. Resist any obligation to implement CMMC Level 2 or higher before DoD formally requires it of VPI's specific contracts.

HSAG Red Line. Cybersecurity standards must be consistent with VPI's existing regulatory obligations; no goldplating. Requirements should track publicly known regulatory frameworks and not require bespoke, unbenchmarked controls.

Proposed Compromise. NIST SP 800-171 as the baseline, with an affirmative commitment to migrate to CMMC upon DoD mandate for VPI's contracts and a good-faith obligation to prepare for CMMC Level 2 assessment in advance of formal contract-level requirement.

G. Penalty Provisions

HSAG Position (Opening). $250,000 per violation per day is acceptable as a maximum subject to: (i) a 30-day cure period following written notice for inadvertent violations; (ii) proportionality between severity and penalty amount; and (iii) a clear definition of "violation" that excludes immaterial, non-recurring administrative oversights (e.g., a missed quarterly report absent recurring non-compliance).

HSAG Red Line. Mandatory divestiture must be reserved for material, uncured violations of core NSA provisions (unauthorized classified access; unauthorized technology transfer to non-U.S. persons or Shanghai; willful concealment of a reportable event). It must not be available for administrative noncompliance.

Anticipated CFIUS Position. Strict liability with limited cure periods. Negotiate for a graduated penalty regime with severity tiers and reserved deployment of the strongest remedies.

H. Term and Sunset

HSAG Position (Opening). NSA to have a defined term of 10 years with mandatory joint review at year 5 and modification available upon mutual agreement or upon materially changed circumstances (e.g., divestiture of the Shanghai subsidiary; declassification of key programs; change in export-control classification of the products).

HSAG Red Line. NSA must not be perpetual without any mechanism for modification. HSAG requires predictability for long-term business planning and capital allocation.

Anticipated CFIUS Position. Indefinite term with modification only at government discretion. Negotiate for periodic review at defined intervals (three-year or five-year cycles) and for a mutual-agreement modification pathway.

CALDERWOOD & HARKNESS LLP
1750 K Street NW, Suite 800, Washington, DC 20006 399 Park Avenue, 31st Floor, New York, NY 10022
PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT PREPARED IN ANTICIPATION OF LITIGATION AND REGULATORY PROCEEDINGS
M E M O R A N D U M
This memorandum is a confidential attorney-client communication and attorney work product prepared by Calderwood & Harkness LLP at the direction of the Vorstand of Halcyon Semiconductor AG for the sole purpose of providing legal advice concerning the pending Committee on Foreign Investment in the United States (CFIUS) review of the transaction described herein. This memorandum may not be reproduced, forwarded, quoted from, or disclosed to any person outside the addressed recipients (and their duly authorized advisors bound by comparable duties of confidentiality) without the prior written consent of the undersigned. Inadvertent disclosure is not intended as a waiver of privilege.
I. Executive Summary
The purpose of this memorandum is to provide the Vorstand of Halcyon Semiconductor AG ("HSAG") with a comprehensive risk assessment of the national security concerns likely to be raised by the Committee on Foreign Investment in the United States ("CFIUS" or the "Committee") in connection with HSAG's proposed acquisition of 100% of the outstanding equity of Marlowe Asset Management Photonics Inc. ("VPI"), and to set forth Calderwood & Harkness's recommended mitigation strategy and initial negotiation positions for the National Security Agreement ("NSA") that we expect will be a condition to clearance. The transaction is being effected pursuant to the Stock Purchase Agreement executed June 10, 2023 (the "SPA"), for aggregate base consideration of $1.42 billion, all cash, on a cash-free, debt-free basis.
Transaction Structure. Halcyon US Holdings Inc., a Delaware C-corporation formed June 5, 2023 as the direct acquisition vehicle ("AcquisitionCo"), will acquire all issued and outstanding shares of VPI at closing. Base purchase price is $1,420,000,000, subject to a customary net working capital true-up. The SPA also provides for a two-tranche earnout of up to $85,000,000 (a $50 million tranche keyed to CY2024 EBITDA and product-qualification milestones and a $35 million tranche keyed to CY2025 revenue thresholds), yielding maximum aggregate consideration of $1,505,000,000.
Financing. The transaction is financed by (i) a $900 million senior secured term loan (Meridian National Bank, administrative agent; Atlas Commercial Lending AG and Pacific Basin Credit Corp., co-lead arrangers; SOFR + 275 bps, five-year tenor, 1% annual amortization with bullet at maturity), and (ii) an HSAG equity contribution of $520 million funded from balance sheet cash and a €300 million draw on HSAG's existing revolving credit facility with Rheinische Handelsbank AG. The debt commitment papers do not contain a CFIUS-related MAC carveout, which we regard as a favorable feature but which also means that Committee-driven delay will directly consume ticking-fee capacity under the commitment letter (see Section VIII).
Filing Type. We recommend, and HSAG has authorized, the filing of a voluntary joint notice under 31 C.F.R. § 800.501. Although a mandatory declaration is required under 31 C.F.R. § 800.401 by virtue of VPI's status as a TID U.S. business dealing in "critical technologies" (as discussed in Section III and analyzed in detail in our separate Mandatory vs. Voluntary Filing Analysis Memorandum dated June 22, 2023), a full voluntary joint notice is decisively preferable given the sensitivity of VPI's classified programs, the near-certainty of second-stage investigation, and the necessity of negotiating a bespoke NSA. Target filing date is July 14, 2023. Pre-filing consultation with the Treasury Office of Investment Security ("OIS") was held on June 19, 2023 (see Appendix B).
Structure of the Analysis. This memorandum identifies seven distinct national security risk factors, assesses the severity of each on a High / Medium-High / Medium scale, proposes a comprehensive mitigation framework, and outlines opening negotiation positions and red lines for the anticipated NSA. A consolidated risk-mitigation matrix appears at Section VII.
Overall Assessment. In our considered judgment, CFIUS clearance is achievable, but the transaction will almost certainly proceed through both a full 45-day review and a 45-day investigation, with clearance conditioned upon the execution of a robust NSA that will impose ongoing compliance, monitoring, and reporting obligations on HSAG and VPI for the foreseeable future. Approval on an unmitigated basis is, in our view, not a realistic outcome. Withdrawal-and-refile is a contingency but should not be assumed as the base case.
Anticipated Lead Agencies. Based on VPI's contract portfolio and technology profile, we expect the Department of Defense ("DoD") to serve as the co-lead review agency, with the Department of Energy ("DOE") likely serving as co-lead in light of the dual-use implications of GaN power electronics for national laboratory and directed-energy programs. The Defense Counterintelligence and Security Agency ("DCSA") is expected to serve as the primary monitoring agency under any resulting NSA.
II. Background: The Target and the Transaction
A. Marlowe Asset Management Photonics Inc. — Business Overview
VPI is a Delaware C-corporation, incorporated February 14, 2009, with principal executive offices at 7400 Ridgeline Parkway, Colorado Springs, CO 80919. Its core business consists of the design and manufacture of advanced gallium-nitride ("GaN") power amplifier chips for defense radar, satellite communications, and 5G infrastructure applications. VPI's manufacturing operations are concentrated at a purpose-built GaN-on-SiC fabrication facility located at 9200 Innovation Boulevard, Albuquerque, NM 87113 (the "Albuquerque Fab"), a 45,000 square-foot facility operating under a DCSA-issued Facility Security Clearance ("FCL") at the SECRET level and identified by CAGE Code 7VK92.
Reported financials for FY2022 are as follows: revenue of $287.4 million; EBITDA of $61.2 million. VPI employs 486 persons on a full-time-equivalent basis, of whom 212 hold active U.S. government personnel security clearances (representing 43.6% of the workforce)—an unusually high cleared-personnel concentration that reflects the classified nature of much of VPI's revenue base.
Key management personnel are as follows:
• Dr. Nathan Trevorrow — CEO and founder; TS/SCI clearance; former DARPA program manager (Microsystems Technology Office).
• Marissa Sung-Avila — President and COO; SECRET clearance; former U.S. Army signal corps officer.
• Col. (Ret.) Bryce Hendrickson, USAF — Vice President, Government Programs, and Facility Security Officer ("FSO"); TS/SCI clearance.
• Derek Wainsborough — CFO; no clearance.
B. VPI Government Contracts and Classified Programs
VPI performs under 14 active DoD prime and subcontract vehicles with an aggregate remaining backlog of approximately $193 million. The five largest by remaining backlog are:
Contracting agencies across the portfolio include U.S. Army PEO IEW&S, the Air Force Research Laboratory (AFRL), the Missile Defense Agency (MDA), NAVSEA (via Ironclad Defense Systems Inc.), and DHS Science & Technology Directorate. A complete contract-level schedule, including performance periods and classification levels, appears at Appendix C.
C. VPI Export Controls and ITAR/EAR Profile
VPI has been registered with the Directorate of Defense Trade Controls ("DDTC") since 2011 under Registration No. M-24817. Certain VPI products constitute defense articles under ITAR Category XI(a)(3) (military electronics — specifically, components for military radar and electronic warfare). Additional dual-use products are classified under the Export Administration Regulations at ECCNs 3A001 (electronic items), 3A991, and 3E001 (associated technology). VPI currently holds three active DSP-5 permanent export licenses authorizing deliveries to NATO allies (specifically, the United Kingdom and Australia). A detailed export-controlled items listing appears at Appendix D.
D. VPI Intellectual Property
VPI's IP portfolio comprises 47 granted U.S. patents and 12 pending U.S. patent applications, organized into three principal patent families: (i) GaN-on-SiC epitaxial growth (8 patents); (ii) HEMT gate structure optimization (19 patents); and (iii) mmWave broadband matching network (20 patents). VPI has separately identified and internally registered 31 categories of trade secrets, principally proprietary GaN epitaxial recipes and die-level reliability screening protocols developed at the Albuquerque Fab.
Of particular importance for CFIUS purposes, 23 of the 47 granted patents were developed under U.S. government-funded contracts and are subject to march-in rights under 35 U.S.C. § 203 and to the government-purpose license and rights-in-data provisions of DFARS 252.227-7038. These patents cannot be assigned, exclusively licensed, or otherwise transferred out of U.S.-owned control without careful navigation of Bayh-Dole and DFARS requirements.
E. Halcyon Semiconductor AG — Acquiror Profile
HSAG is a publicly traded German Aktiengesellschaft with shares listed on the Frankfurt Stock Exchange (XETRA: HLC). Market capitalization as of June 1, 2023 was approximately €14.8 billion. HSAG is headquartered at Industriestraße 44, 01099 Dresden, Saxony, Germany, and is registered with the Amtsgericht Dresden under HRB 28416 (LEI: 5299007KXQ2M4GHILZ38). Reported FY2022 revenue was €6.12 billion; EBITDA was €1.37 billion.
HSAG's existing U.S. footprint is limited to Halcyon US Inc., a fabless design center at 11501 Alterra Parkway, Suite 300, Austin, TX 78758, employing approximately 320 persons. Halcyon US Inc. performs no classified work and holds no FCL.
Key HSAG management personnel are Dr. Maximilian Ehrhardt (CEO, German citizen, no U.S. clearance); Katarina Brückner (CFO, German citizen, no U.S. clearance); and Stefan Lohse (General Counsel, dual German/U.S. citizen, admitted to the New York bar, Georgetown LL.M., no U.S. clearance). Our due diligence has identified no German government ownership, veto rights, golden shares, or comparable state influence over HSAG. HSAG is not on any BIS Entity List, SDN List, or comparable restriction list.
HSAG operates a Chinese subsidiary, Halcyon Semiconductor (Shanghai) Co., Ltd., which recorded FY2022 revenue of approximately $81.4 million (approximately 1.3% of HSAG consolidated revenue). Shanghai operations are limited to consumer-grade power management integrated circuits; the subsidiary conducts no GaN, RF, defense, or dual-use activities. Notwithstanding the limited scope of the Shanghai operations, we anticipate that the mere existence of a China subsidiary will attract Committee scrutiny (see Risk Factors 2, 4, and 5 below).
F. Existing VPI Shareholders
The pre-closing capitalization of VPI is as follows:
We have confirmed with seller's counsel that Ridgecrest Ventures Fund III and Cascadian Capital Partners Growth Fund II have no foreign limited partners with individual interests exceeding 10%, and neither fund has foreign-government limited partners. This confirmation will be documented in the notice.
G. Transaction Valuation Context
Enterprise value at closing is $1.42 billion, implying multiples of approximately 4.94x LTM revenue and 23.2x LTM EBITDA—multiples consistent with recent defense-adjacent semiconductor precedent transactions. Consideration is 100% cash at closing.
A closing escrow holdback of $71,000,000 (5% of base purchase price) will be held for 18 months by Pinnacle Trust Company, N.A. (Chicago) as escrow agent. Representations and warranties insurance has been bound with Graystone Specialty Insurance Company (Policy No. GSI-RW-2023-04821): policy limit $142,000,000 (10% of purchase price); retention $14,200,000 (1%); premium $4,970,000 (3.5% of policy limit). The R&W policy contains a customary carve-out for CFIUS/national security matters known at binding; we have negotiated the carve-out narrowly and it does not exclude the general categories of representations relevant here.
III. CFIUS Jurisdictional Basis and Expected Review Process
The transaction is a "covered transaction" under 31 C.F.R. § 800.213 because it involves a foreign person (HSAG, a German AG, acting through AcquisitionCo) acquiring "control" (in fact, 100% ownership) of a U.S. business (VPI). No jurisdictional argument is available to HSAG that would place the transaction outside CFIUS's reach, and none should be attempted; the strategic posture is one of full and proactive engagement.
VPI qualifies as a "TID U.S. business" within the meaning of 31 C.F.R. § 800.248 for at least two independent reasons: (i) VPI produces items classified under ECCN 3A001 (dual-use GaN semiconductors) and ITAR Category XI(a)(3) (defense articles), each of which is a "critical technology" within the meaning of § 800.215; and (ii) export of those items to HSAG's home jurisdiction (Germany) requires U.S. regulatory authorization from DDTC and/or BIS.
Because both prongs of the § 800.401 mandatory declaration test are met, a mandatory filing obligation attaches. As set forth in our June 22, 2023 Mandatory vs. Voluntary Filing Analysis Memorandum, however, we strongly recommend—and HSAG has authorized—the filing of a full voluntary joint notice under 31 C.F.R. § 800.501 in lieu of a short-form declaration. The declaration procedure is ill-suited to a transaction of this complexity and sensitivity; the Committee would almost certainly request a full notice at the conclusion of the 30-day declaration assessment period, resulting in delay without commensurate benefit.
The expected process is as follows:
1. Pre-filing consultation (completed June 19, 2023 with Treasury OIS).
2. Draft notice submission (early July 2023) for informal Committee comment.
3. Formal filing of the joint voluntary notice (target: July 14, 2023).
4. Acceptance by CFIUS staff following review for completeness (typically 5–7 business days).
5. 45-day review period commencing on the acceptance date.
6. 45-day investigation period, which we regard as essentially certain given the classified programs, ITAR-controlled technology, and cleared personnel involved.
7. Mitigation negotiation in parallel with the investigation, followed by NSA execution and clearance.
We expect DoD and DOE to serve as co-lead agencies. DCSA will be the operational monitoring agency post-clearance and will be a substantive participant in NSA negotiation, particularly on FOCI mitigation elements. Other agencies expected to participate substantively include Commerce (BIS), State (DDTC), Justice (National Security Division), and the Intelligence Community assessment element (ODNI).
Pre-Filing Consultation Feedback. In the June 19, 2023 pre-filing meeting, Treasury OIS staff (Marta Chen, Deputy Director; Robert Feldman, Senior Case Officer) identified three preliminary areas of focus: (i) HSAG's China operations, particularly the Shanghai subsidiary, and the sufficiency of controls preventing any downstream technology or personnel flow from VPI to Chinese entities; (ii) HSAG's cybersecurity posture and the specific plan for IT segregation between VPI and HSAG's global network; and (iii) the post-closing governance architecture for VPI, and specifically whether HSAG intends to propose an SSA-equivalent NSA. Staff did not identify any preliminary "showstoppers." A more complete summary appears at Appendix B.
IV. National Security Risk Factor Analysis
We have identified seven principal national security risk factors, analyzed below. Each analysis addresses (A) the nature of the risk, (B) our severity assessment, and (C) our proposed mitigation approach.
Risk Factor 1: Foreign Access to Classified Defense Programs
A. Description of Risk. VPI holds an FCL at the SECRET level at the Albuquerque Fab (CAGE Code 7VK92). Of the 486 total VPI employees, 212 (43.6%) hold active U.S. government personnel security clearances at either the SECRET or TS/SCI level. Col. (Ret.) Bryce Hendrickson, USAF (TS/SCI) serves as the FSO of record. VPI performs on multiple classified programs, including work under Army, AFRL, and MDA contracts, and, through its subcontract with Ironclad Defense Systems Inc., contributes to NAVSEA classified naval programs.
Post-acquisition, HSAG—as a foreign entity—would hold indirect ownership of, and would in the absence of mitigation exert influence over, a cleared contractor facility and a substantial cleared workforce. The Committee's baseline concern is straightforward and paramount: unauthorized foreign access to classified national defense information, whether by design or by ordinary integration processes, and the associated espionage and counterintelligence risk.
B. Severity Assessment. HIGH. The classified programs are the single most sensitive element of the transaction. Any perception—whether well-founded or not—that HSAG or any HSAG affiliate could obtain access to classified information would be effectively disqualifying. CFIUS precedent in analogous transactions (see the comparative NSA analysis at Appendix E) uniformly requires SSA-equivalent FOCI mitigation for any foreign acquisition of a cleared contractor.
Germany's status as a NATO ally with a mature bilateral General Security of Military Information Agreement (GSOMIA) and deep intelligence-sharing relationships is a contextual mitigant but does not obviate the need for formal mitigation. NISPOM does not permit FCL retention under foreign ownership without an approved mitigation instrument, allied nationality notwithstanding.
C. Proposed Mitigation.
• The NSA to be structured as a Special Security Agreement ("SSA") equivalent under NISPOM (32 C.F.R. Part 117).
• Reconstitution of the VPI board to include a majority of "Security Board Members" who are U.S. citizens holding or eligible for TS/SCI clearances, with exclusive authority over classified programs and personnel security matters.
• Establishment of a Government Security Committee ("GSC") composed solely of Security Board Members and reporting to DCSA.
• Col. (Ret.) Hendrickson to be retained as FSO, reporting directly to the GSC.
• HSAG-designated directors to be absolutely prohibited from accessing classified information; they will be provided with sanitized summaries of GSC activities only.
• Physical access restrictions: HSAG personnel excluded from the classified areas of the Albuquerque Fab—specifically clean-room Sections C-7 through C-12—without prior written approval of both DCSA and the GSC on a per-visit basis.
Risk Factor 2: Transfer of ITAR/EAR-Controlled Technology to Non-U.S. Persons
A. Description of Risk. VPI's product portfolio includes ITAR Category XI(a)(3) defense articles and EAR-controlled items under ECCNs 3A001, 3A991, and 3E001 (the last of which covers associated technology and constitutes a particularly acute deemed-export concern). VPI's DDTC registration (M-24817) and three active DSP-5 export licenses further evidence the export-controlled character of its output.
Post-closing, in the ordinary course of parent-subsidiary integration—financial reporting, engineering collaboration, product roadmap alignment, cross-hire, joint procurement—HSAG personnel who are German or other non-U.S. nationals could request or inadvertently receive access to controlled technical data. Any such transfer would constitute a "deemed export" or "deemed re-export" and, if unauthorized, would violate the Arms Export Control Act (22 U.S.C. § 2778), the ITAR (22 C.F.R. Parts 120–130), the Export Control Reform Act (50 U.S.C. § 4801 et seq.), and/or the EAR (15 C.F.R. Parts 730–774). Consequences range from administrative debarment to criminal exposure.
The Committee's concern extends beyond intentional misconduct to structural risk—that post-closing integration will, over time, erode the technical and organizational separation between VPI's controlled technology base and HSAG's global operations (Germany, Austin, and, most sensitively, Shanghai).
B. Severity Assessment. HIGH. ITAR/EAR technology-transfer risk is consistently the most heavily litigated mitigation subject in semiconductor-sector CFIUS transactions. The dual ITAR/EAR character of VPI's product line creates multiple vectors for unauthorized transfer. HSAG's Shanghai subsidiary—while small, commercially remote from VPI's product line, and confined to consumer-grade power ICs—will nevertheless draw scrutiny as a hypothetical secondary transfer node, and the Committee will require affirmative structural assurance that Shanghai is walled off from VPI in perpetuity.
C. Proposed Mitigation.
• Adoption of a formal, written Technology Control Plan ("TCP") governing access to, use of, and transfer of all VPI technical data and technology, annexed to and enforceable under the NSA.
• Absolute prohibition on the transfer of any ITAR- or EAR-controlled technical data to any non-U.S. person absent prior U.S. government authorization (DDTC license, BIS license, deemed-export license, or applicable exemption).
• Organizational, physical, and IT segregation of VPI's export-controlled R&D and manufacturing from HSAG's global operations, with a hard prohibition on any technology sharing between VPI and Halcyon Semiconductor (Shanghai) Co., Ltd.
• Pre-authorization protocol for all cross-border technology sharing: GSC approval plus, where applicable, DDTC or BIS licensure obtained in advance.
• Mandatory export-controls training for all VPI and relevant HSAG personnel, with annual refresher and per-hire onboarding.
• Annual TCP compliance audits by the third-party monitor (see Section V.E).
Risk Factor 3: Supply Chain Disruption and Critical Defense Supply Continuity
A. Description of Risk. VPI is a key supplier of GaN power amplifier components to several critical DoD modernization programs, including the AN/TPS-80 radar (Army), next-generation mmWave amplifier programs (AFRL), T/R modules for missile defense architectures (MDA), and naval RF systems (via Ironclad Defense Systems Inc. to NAVSEA). VPI's aggregate backlog across 14 active contracts totals $193 million, and for several product lines VPI is, if not formally sole-source, then functionally so given the proprietary GaN-on-SiC epitaxial recipes and program-specific qualifications.
Change-of-ownership events—even benign ones—create disruption risk in three dimensions: (i) contract performance interruption during novation and re-qualification; (ii) contracting officer discomfort with foreign ownership, potentially manifesting as delayed novation, reduced follow-on procurement, or (in the worst case) reprocurement to a domestic source; and (iii) counterparty confidence erosion among program offices and prime contractors.
B. Severity Assessment. HIGH. GaN power amplifiers are essential to multiple DoD modernization programs; VPI occupies a strategically significant node in the domestic defense industrial base. The products are difficult to second-source in the short term. Novation under FAR Subpart 42.12 requires affirmative contracting officer approval on a contract-by-contract basis and may face resistance if CFIUS concerns are not visibly addressed.
C. Proposed Mitigation.
• NSA commitment to maintain VPI's U.S.-based manufacturing operations at the Albuquerque Fab for a minimum period. Proposed opening position: five years, with automatic annual renewal thereafter subject to notice.
• No relocation of manufacturing or production lines outside the United States absent prior CFIUS notification and, for cleared or export-controlled lines, approval.
• Personnel-continuity provisions: retention of Dr. Trevorrow, Ms. Sung-Avila, and Col. Hendrickson for a minimum of 24 months post-closing; replacements subject to GSC and DCSA approval.
• 30-day pre-notification to CFIUS before any material change to VPI's business, including divestitures, material foreign subcontracts, or changes to cleared personnel.
• Affirmative commitment to support the FAR 42.12 novation process for all 14 active government contracts. Our contracts team has identified 8 contracts likely requiring formal novation agreements and 6 that we assess can proceed by change-of-name agreement or contract-level notification alone.
• Maintenance of VPI as a separately managed U.S. subsidiary with independent contracting authority, its own certifications and representations, and its own supply-chain risk management program.
Risk Factor 4: Cybersecurity Risks from Foreign IT Integration
A. Description of Risk. Any post-closing integration of VPI's IT environment with HSAG's global corporate network would create pathways—intentional or not—for unauthorized access to controlled technical data, classified program information, and proprietary trade secrets. HSAG operates a global IT infrastructure spanning Germany, China (Shanghai), and the U.S. (Austin). VPI's current IT environment supports both classified and unclassified operations and is subject to, among other things, the security-control requirements of NIST SP 800-171 (as incorporated by DFARS 252.204-7012) and, for classified information systems, DCSA-authorized configurations under NISPOM.
CFIUS's cybersecurity concerns encompass both direct integration (shared identity providers, shared cloud tenancy, shared endpoint management) and indirect exposure (VPI reliance on HSAG-managed services, or the introduction of HSAG-based cyber threat exposure into VPI's environment).
B. Severity Assessment. MEDIUM-HIGH. Cybersecurity has emerged as one of the most heavily scrutinized subject areas in CFIUS reviews since the SolarWinds and Microsoft Exchange incidents of 2020–2021. Treasury flagged cybersecurity specifically at the June 19 pre-filing meeting. HSAG's ISO 27001 certification is a favorable baseline, but it is not sufficient by itself to address the specific concerns raised by a cleared defense contractor acquisition.
C. Proposed Mitigation.
• Full physical and logical segregation of VPI IT systems from the HSAG global network. No shared identity provider, no shared endpoint management, no shared cloud tenancy.
• VPI to maintain NIST SP 800-171 compliance on an independent basis; VPI's SPRS score to be maintained at or above current baseline.
• Annual third-party penetration testing of VPI IT systems by a monitor-approved firm.
• Cybersecurity incident reporting to DCSA within 72 hours of discovery of any reportable event.
• HSAG IT personnel prohibited from accessing or administering VPI systems absent prior GSC approval and, where applicable, U.S. person status verification.
• VPI to maintain a dedicated cybersecurity staff (proposed: minimum 6 FTEs including CISO) reporting into the GSC.
• Incident response plan and continuity-of-operations plan to be reviewed and approved by DCSA and refreshed annually.
Risk Factor 5: Foreign Ownership, Control, or Influence (FOCI)
A. Description of Risk. HSAG's 100% acquisition of VPI equity creates direct foreign ownership of a cleared contractor. Under NISPOM, foreign ownership, control, or influence ("FOCI") over a cleared entity must be mitigated to a level acceptable to DCSA in order to retain the FCL. In assessing FOCI, the Committee and DCSA will examine, among other factors: (i) whether any foreign government exercises direct or indirect influence over HSAG (via ownership, veto, board rights, industrial policy leverage, or otherwise); (ii) HSAG's board composition and shareholder base; (iii) HSAG's relationships with non-allied governments; and (iv) HSAG's operations in jurisdictions of concern, principally the PRC.
B. Severity Assessment. MEDIUM. Germany is a NATO ally with established intelligence-sharing arrangements. No German government ownership of HSAG has been identified; HSAG's largest shareholders are institutional asset managers with fiduciary rather than strategic postures. HSAG's Shanghai subsidiary is the principal contextual concern, but its scale (approximately 1.3% of consolidated revenue) and commercial character (consumer-grade PMICs) render it a manageable rather than disqualifying element.
C. Proposed Mitigation.
• NSA to function as the FOCI mitigation instrument, structured as an SSA equivalent under NISPOM.
• Board restructuring (see Risk Factor 1) placing a majority of Security Board Members with clearances on the VPI board.
• GSC exclusive authority over classified and ITAR-controlled programs, insulating those matters from any HSAG influence.
• HSAG to provide annual certifications regarding (i) its ownership structure (including any threshold changes in beneficial ownership), (ii) any government relationships or ownership stakes exceeding a de minimis threshold, and (iii) material changes to Halcyon Semiconductor (Shanghai) Co., Ltd.'s operations, ownership, or product scope.
• VPI to maintain separate corporate governance, financial reporting (with appropriate consolidation carve-outs for classified matters), and contracting authority from HSAG global operations.
Risk Factor 6: Continuity of Cleared Personnel and Key Employees
A. Description of Risk. The 212 cleared employees represent both a compliance asset and a security-sensitive population. The three key personnel—Dr. Trevorrow, Ms. Sung-Avila, and Col. Hendrickson—are critical to VPI's classified program performance, its customer relationships, and its FCL maintenance. Change-of-control transactions frequently produce personnel attrition; unmanaged attrition of cleared personnel would impair contract performance and potentially trigger FCL review. Loss of Col. Hendrickson as FSO would trigger DCSA notification requirements and, absent an approved successor, potential FCL suspension.
B. Severity Assessment. MEDIUM-HIGH. Personnel continuity is both a security concern and a practical concern for program performance. CFIUS has, with increasing frequency, required specific personnel-retention provisions in NSAs for cleared contractor transactions since approximately 2020.
C. Proposed Mitigation.
• NSA to require that Dr. Trevorrow, Ms. Sung-Avila, and Col. Hendrickson each remain employed by VPI for a minimum of 24 months post-closing.
• Any departure or replacement of these key personnel to be subject to GSC review and DCSA notification (and, in the case of the FSO, DCSA approval of successor).
• The FSO role to be specifically identified in the NSA, with a written succession plan approved by DCSA.
• HSAG to commit contractually to maintaining competitive compensation, benefits, and retention economics for cleared VPI employees, and to a "no material adverse change" standard for cleared-employee compensation and benefits during the retention period.
• 30-day pre-notification to CFIUS of any material changes to cleared personnel (departures, key new hires, clearance terminations, adverse security actions).
Risk Factor 7: Government Contract Continuity and Regulatory Compliance
A. Description of Risk. The transaction triggers a cascading set of regulatory notification and consent requirements independent of CFIUS itself:
• Each of VPI's 14 active contracts requires either novation or change-of-name treatment under FAR Subpart 42.12.
• The change in ownership triggers foreign-ownership disclosure under DFARS 252.209-7002.
• VPI's DDTC registration (M-24817) requires notification of change of ownership under ITAR § 122.4(a) within 60 days.
• Each of the 3 active DSP-5 export licenses requires amendment to reflect the new ownership structure.
• BIS notification may be required with respect to certain ECCN 3E001 technology holdings.
Failure to comply timely with any of these obligations carries significant collateral consequences: contract termination, stop-work orders, ITAR administrative debarment, license invalidation, and civil or criminal penalties.
B. Severity Assessment. MEDIUM. These are largely procedural and administrable requirements, but the aggregate compliance burden is substantial and the cost of any single misstep is high. The FAR 42.12 novation process for the 8 novation-required contracts is expected to require six to twelve months and to demand contracting-officer engagement on a per-contract basis.
C. Proposed Mitigation.
• NSA commitment to prompt compliance with all FAR 42.12 novation obligations, with a targeted completion window.
• VPI to file DFARS 252.209-7002 foreign-ownership disclosures with each cognizant contracting officer within the required timeframe post-closing.
• Filing of the ITAR § 122.4(a) DDTC change-of-ownership notification promptly post-closing.
• Amendment filings for all three active DSP-5 licenses.
• Continuity of existing contracting relationships and points of contact through the novation transition, with early contracting-officer outreach led by Col. Hendrickson (or successor FSO) beginning within 10 business days of CFIUS clearance.
V. Comprehensive Mitigation Framework
The following framework consolidates and structures the mitigation measures proposed in Section IV into a coherent NSA architecture. This framework should be understood as our recommended opening position; specific terms will be refined during NSA negotiation with the co-lead agencies.
A. Board Restructuring and Corporate Governance
We recommend a five-member reconstituted VPI board, comprising:
• Three Security Board Members — U.S. citizens holding or eligible for TS/SCI clearances. At least one Security Board Member to be an "Independent Security Director" appointed with CFIUS approval and with no prior or ongoing commercial relationship with either HSAG or VPI.
• Two HSAG designees — persons designated by HSAG for oversight of commercial operations. HSAG designees may not access classified information under any circumstances and will receive sanitized summaries only of GSC-privileged matters.
Our proposed Security Board Members are: (i) Col. (Ret.) Bryce Hendrickson (TS/SCI); (ii) Adrienne Delacroix, currently an independent director of VPI (SECRET clearance, cleared for expedited upgrade); and (iii) an Independent Security Director to be identified during NSA negotiation. We have preliminarily identified three candidates for the Independent Security Director role and will circulate biographical materials under separate cover for the Vorstand's consideration prior to formal proposal to CFIUS.
HSAG's two designees are, in the base case, expected to be Dr. Ehrhardt (or his delegate) and one further nominee to be determined, focused on commercial oversight and integration.
The Government Security Committee ("GSC") will be composed exclusively of the three Security Board Members and will have exclusive board-level authority over: classified programs; ITAR-controlled activities; personnel security matters; facility security; and all matters of NSA compliance. All other matters (commercial strategy, budgets, non-classified capital expenditure, non-cleared executive compensation, dividend policy) remain within the authority of the full board.
B. Technology Control Plan (TCP)
The TCP will be a formal, written plan annexed to the NSA and independently enforceable under it. Its principal elements are:
1. An absolute prohibition on the transfer of ITAR- or EAR-controlled technical data to any non-U.S. person absent prior U.S. government authorization or applicable exemption.
2. Detailed procedures identifying categories of information that may permissibly flow between VPI and HSAG (financial reporting data, aggregated operational metrics, non-controlled commercial data, publicly available product information), with clearly delineated escalation and approval workflows.
3. Physical and procedural access controls at VPI facilities, including the classified-area exclusion zones.
4. Recordkeeping and audit requirements sufficient to permit meaningful monitor and DCSA review.
5. Personnel training obligations, both role-based and general.
C. Facility Access Restrictions
HSAG personnel who are not U.S. persons are prohibited from accessing the classified areas of the Albuquerque Fab (specifically, clean-room Sections C-7 through C-12) except with prior written approval from both DCSA and the GSC on a per-visit basis. Access to unclassified areas is permitted subject to advance notice, escort by a cleared VPI employee, and standard visitor logging and prohibited-items protocols. A detailed access procedures annex will be attached to the NSA.
D. IT and Data Segregation
VPI's IT systems will be physically and logically separated from HSAG's global network. This means: no shared identity provider; no shared cloud tenancy; no shared endpoint management; no shared VPN infrastructure; and no shared help-desk or SOC operations. VPI will maintain NIST SP 800-171 compliance independently and will submit its own SPRS score. Third-party penetration testing will be conducted annually. Incident reporting to DCSA is required within 72 hours. VPI will maintain a dedicated cybersecurity staff of at least six FTEs reporting to the GSC through the CISO.
E. Third-Party Compliance Monitor
An independent third-party monitor with TS/SCI clearance will conduct annual compliance audits and report to CFIUS monitoring agencies. Our recommended candidate is:
• Whitmore Compliance Group LLC — Principal: Gerald Whitmore (former FBI Counterintelligence Division; active TS/SCI clearance; approximately 22 years of federal service). Offices: 1300 Crystal Drive, Suite 710, Arlington, VA 22202.
Whitmore Compliance Group has served as monitor on eight comparable semiconductor-sector NSAs since 2019 and is well-known to DCSA and Treasury OIS staff. Monitor scope will include annual audits covering all NSA compliance areas (board governance, TCP compliance, cybersecurity, facility access, data segregation, personnel continuity) plus ad hoc reviews upon incident or Committee request.
Cost will be borne by HSAG. Based on benchmarking against comparable semiconductor-sector monitor engagements, we anticipate an annual fee in the range of $1.0 million to $1.5 million, payable quarterly, subject to reasonable expense reimbursement. The monitor must be formally approved by CFIUS during NSA negotiation.
F. Personnel Continuity
Dr. Trevorrow, Ms. Sung-Avila, and Col. Hendrickson to remain employed for a minimum of 24 months post-closing, with departures or replacements subject to GSC review and DCSA notification (and, for the FSO role, DCSA approval). FSO succession plan to be filed with DCSA within 60 days of closing. HSAG to commit to competitive compensation and benefits for cleared VPI employees generally.
G. Pre-Notification of Material Changes
30-day advance notification to CFIUS required for any material change to VPI's business, including divestitures, material foreign subcontracts, changes to cleared personnel, material changes to manufacturing operations, and changes to VPI's product line requiring new ITAR or EAR classifications. Annual compliance reports to the co-lead agencies. Annual certifications from HSAG regarding ownership structure and foreign government relationships.
H. Penalty and Enforcement Provisions
The standard NSA penalty framework provides for civil penalties up to $250,000 per violation per day, injunctive relief, and, in the most serious cases, mandated divestiture. Our negotiation objectives with respect to this framework are: (i) proportionality between severity and remedy; (ii) meaningful cure periods for inadvertent, non-material violations; (iii) clear definition of what constitutes a "violation" and specifically the exclusion of immaterial administrative oversights; and (iv) express recognition that divestiture is a remedy of last resort available only for material, uncured violations of core provisions.
VI. Initial Negotiation Positions for NSA Terms
The following sets forth our recommended opening positions, red lines, and anticipated Committee positions for each principal NSA term. These positions should be understood as opening postures, subject to iteration and refinement during negotiation.
A. Board Composition and Governance
HSAG Position (Opening). Accept a five-member board consisting of three Security Board Members and two HSAG designees. Preserve full-board authority over non-classified, non-ITAR commercial matters, including budgets, non-classified capital expenditure, commercial strategy, and executive compensation for non-cleared roles.
HSAG Red Line. HSAG must retain meaningful board representation and commercial governance authority. GSC authority should be strictly limited to classified/controlled programs and security matters and should not migrate into broader commercial or technology decision-making.
Anticipated CFIUS Position. Broad GSC authority, potentially extending to any technology-related decision (including commercial R&D) and to key hiring/firing beyond the security-clearance-holding population. We should resist migration of GSC authority into commercial matters and preserve a bright line between security and commercial governance.
B. TCP Scope
HSAG Position (Opening). TCP scope narrowly tailored to ITAR/EAR-controlled technical data. Commercial, non-controlled information (financial reporting, aggregated operational metrics, publicly available product information) to flow freely between VPI and HSAG in the ordinary course.
HSAG Red Line. HSAG must be able to receive non-controlled financial, operational, and commercial data sufficient to satisfy IFRS consolidation, public-disclosure obligations under German securities laws, and ordinary parent-company reporting.
Anticipated CFIUS Position. Expansive TCP potentially covering all "technical data" without regard to control status. Negotiate for clear categorical carve-outs and a rules-based rather than approval-based information flow regime for non-controlled data.
C. Monitor Scope and Independence
HSAG Position (Opening). Monitor scope limited to verifying NSA compliance. No operational authority over VPI. No veto power over VPI business decisions. Annual audit framework with ad hoc reviews only upon reasonable cause.
HSAG Red Line. The monitor is an auditor, not a manager. Monitor costs must be reasonable and benchmarked against comparable engagements. The monitor should not be empowered to expand its own scope unilaterally.
Anticipated CFIUS Position. Broad monitor authority with real-time access, potentially including on-site presence and continuous data feeds. We should push firmly for a defined annual audit framework with ad hoc reviews confined to reasonable-cause triggers.
D. Cost Allocation
HSAG Position (Opening). HSAG bears monitor costs as part of the cost of acquisition. Annual fee cap, with CPI-only escalation.
Anticipated Range. $1.0 million to $1.5 million per annum, based on comparable semiconductor-sector NSA engagements (see Appendix E).
HSAG Red Line. No open-ended cost obligations. Government agencies must not have unilateral authority to expand monitor scope (and cost) without consultation. Ad hoc reviews to be capped or scope-defined in advance.
E. Personnel Continuity
HSAG Position (Opening). Accept 24-month retention commitment for the three key personnel (Trevorrow, Sung-Avila, Hendrickson). Voluntary resignations to be excluded from the retention obligation, provided (i) the resignation is genuinely voluntary and not induced by HSAG action; (ii) HSAG promptly identifies a qualified replacement; and (iii) the replacement is approved by the GSC and, for the FSO role, by DCSA.
Anticipated CFIUS Position. Strict retention obligation with penalties for any departure regardless of cause. Negotiate for a clear distinction between voluntary resignations and involuntary terminations, with penalties confined to the latter.
F. Cybersecurity. HSAG Position (Opening). NIST SP 800-171 (with DFARS 252.204-7012 implementation) is the appropriate baseline standard, consistent with VPI's existing government contract obligations. Resist any obligation to implement CMMC Level 2 or higher before DoD formally requires it of VPI's specific contracts.
HSAG Red Line. Cybersecurity standards must be consistent with VPI's existing regulatory obligations; no goldplating. Requirements should track publicly known regulatory frameworks and not require bespoke, unbenchmarked controls.
Proposed Compromise. NIST SP 800-171 as the baseline, with an affirmative commitment to migrate to CMMC upon DoD mandate for VPI's contracts and a good-faith obligation to prepare for CMMC Level 2 assessment in advance of formal contract-level requirement.
G. Penalty Provisions
HSAG Position (Opening). $250,000 per violation per day is acceptable as a maximum subject to: (i) a 30-day cure period following written notice for inadvertent violations; (ii) proportionality between severity and penalty amount; and (iii) a clear definition of "violation" that excludes immaterial, non-recurring administrative oversights (e.g., a missed quarterly report absent recurring non-compliance).
HSAG Red Line. Mandatory divestiture must be reserved for material, uncured violations of core NSA provisions (unauthorized classified access; unauthorized technology transfer to non-U.S. persons or Shanghai; willful concealment of a reportable event). It must not be available for administrative noncompliance.
Anticipated CFIUS Position. Strict liability with limited cure periods. Negotiate for a graduated penalty regime with severity tiers and reserved deployment of the strongest remedies.
H. Term and Sunset
HSAG Position (Opening). NSA to have a defined term of 10 years with mandatory joint review at year 5 and modification available upon mutual agreement or upon materially changed circumstances (e.g., divestiture of the Shanghai subsidiary; declassification of key programs; change in export-control classification of the products).
HSAG Red Line. NSA must not be perpetual without any mechanism for modification. HSAG requires predictability for long-term business planning and capital allocation.
Anticipated CFIUS Position. Indefinite term with modification only at government discretion. Negotiate for periodic review at defined intervals (three-year or five-year cycles) and for a mutual-agreement modification pathway.
VII. Risk-Mitigation Matrix Summary Table
The following consolidated matrix summarizes the seven risk factors, associated severity ratings, primary concerns, proposed mitigation measures, anticipated NSA section references, and HSAG negotiation priority (1 = highest, 3 = lowest).
VIII. Anticipated CFIUS Timeline and Process
The following timeline reflects our current best estimates. Actual timing will depend on Committee workload, RFI responsiveness, agency positions, and the pace of NSA negotiation.
We note that the debt commitment letter's ticking-fee grid begins to accrue at an elevated rate at the 180-day mark; the current base-case timeline sits within that window, but any material Committee delay will begin to erode that headroom. We are coordinating with the transaction team to assess extension options with Meridian National Bank if slippage becomes likely.
IX. Coordination with Other Workstreams
A. Seller's Counsel Coordination
Wethersfield & Gale LLP (Harrison Whitfield, lead partner; Sandra Niehaus; Tobias Kwan) represents VPI and the selling shareholders. The joint notice under 31 C.F.R. § 800.501 requires substantive cooperation between buyer's and seller's counsel; responsibilities have been delineated in the pre-filing coordination letter dated June 15, 2023. VPI management—particularly Dr. Trevorrow and Col. Hendrickson—will be principal contributors to notice exhibits concerning government contracts, classified programs, cleared personnel, and export-controlled items.
B. German Counsel
Schilling Frey Rechtsanwälte (Prof. Dr. Ulrich Schilling, lead partner) is assisting with German corporate governance disclosures, HSAG ownership structure documentation, and confirmation of the absence of German government control or influence. Their work product will be integrated into the notice exhibits addressing HSAG's ownership and governance.
C. IP and Export Control Diligence
Omar Siddiqui (IP partner) and Christy Bauer (senior counsel, export controls) of Calderwood & Harkness are conducting parallel workstreams: (i) ITAR/EAR classification review of VPI's product portfolio; (ii) patent portfolio analysis, including analysis of the 23 patents subject to Bayh-Dole march-in and DFARS 252.227-7038 rights-in-data provisions; and (iii) a freedom-to-operate assessment. Their findings will inform the notice exhibits and the initial TCP drafting.
D. M&A Transaction Team
Beatrice Holloway (partner), James Prentice (senior associate), and Kenneth Morales (associate) are coordinating SPA conditions, closing mechanics, and integration of CFIUS-related conditions and covenants into the acquisition agreement. SPA § 7.1(c) conditions closing to the receipt of CFIUS clearance and, if applicable, execution of a mutually acceptable NSA.
E. Financial and Tax Advisors
Ashgrove Capital Group (Philippe Beaumont, Managing Director) serves as HSAG's financial advisor and is supporting valuation and financial-disclosure elements of the notice. Pemberton Kline LLP (Richard Pemberton, tax partner) is advising on transaction tax structure, including the treatment of the earnout and the escrow. Both advisors have been briefed on CFIUS-relevant disclosure requirements and have committed to make personnel available for notice-drafting sessions as needed.
X. Recommendations and Next Steps
We recommend the following actions in the coming three-week period leading up to filing:
1. Finalize and file the voluntary joint notice by July 14, 2023, targeting CFIUS acceptance on or about July 21, 2023.
2. Prepare comprehensive notice exhibits, with particular emphasis on VPI's classified programs, export-controlled items, government contracts, and cleared personnel. Draft exhibits are due to Calderwood & Harkness in near-final form by July 5, 2023.
3. Develop a detailed TCP draft in advance of NSA negotiations to demonstrate proactive compliance posture and to anchor the negotiation baseline in HSAG's preferred framework.
4. Identify and vet the proposed Security Board Members and Independent Security Director candidate for submission to CFIUS during NSA negotiation. Biographical and clearance-eligibility materials to be circulated to the Vorstand for review by July 3, 2023.
5. Engage Whitmore Compliance Group LLC on a preliminary basis as the preferred third-party monitor candidate; prepare biographical and qualification materials for CFIUS review during the investigation phase.
6. Prepare an HSAG cybersecurity program overview for supplemental submission, emphasizing ISO 27001 certification, existing SOC operations, and the specific plan for VPI IT segregation.
7. Prepare detailed disclosure regarding Halcyon Semiconductor (Shanghai) Co., Ltd.—including corporate structure, product line, customer base, personnel, and post-closing walls—to pre-empt CFIUS concerns.
8. Coordinate with David Caruso on government contract novation planning, including per-contract novation strategy, contracting officer engagement plan, and DFARS 252.209-7002 disclosure preparation.
9. Establish an internal CFIUS response team at HSAG (Dr. Ehrhardt, Ms. Brückner, Mr. Lohse, plus a designated Vorstand secretariat contact) for rapid decision-making during review and investigation. Response time to Committee RFIs is typically 3 business days.
10. Schedule weekly status calls between the Calderwood & Harkness CFIUS team and HSAG management throughout the filing and review process, with escalation protocols for time-sensitive matters.
We are available at any time to discuss the foregoing and to address any questions the Vorstand may have. Given the sensitivity of the matters addressed herein, we ask that any distribution of this memorandum beyond the addressed recipients be coordinated with Beatrice Holloway or Margaret Ashworth in advance.
Respectfully submitted,
CALDERWOOD & HARKNESS LLP
________________________________________
Beatrice Holloway Responsible Partner, M&A
________________________________________
Margaret "Peggy" Ashworth Of Counsel, National Security & CFIUS
________________________________________
David Caruso Lt. Col. (Ret.), USAF Senior Counsel, Government Contracts & Export Controls
XI. Appendices
Appendix A: Glossary of Key Terms and Acronyms
Appendix B: Summary of Pre-Filing Consultation (June 19, 2023)
Cross-reference: Pre-Filing Meeting Summary Memorandum (Calderwood & Harkness, June 20, 2023, Matter No. 1032-00004, distributed to Vorstand).
Attendees. Treasury OIS: Marta Chen (Deputy Director), Robert Feldman (Senior Case Officer). Calderwood & Harkness: Ashworth, Caruso, Holloway. HSAG: Lohse (by video).
Key Treasury Feedback Points.
1. Treasury OIS expressed preliminary focus on Halcyon Semiconductor (Shanghai) Co., Ltd. and requested that the notice include detailed disclosure of its operations, personnel, customer base, and post-closing separation from VPI.
2. Cybersecurity posture identified as an area of interest; Treasury requested specific detail on planned IT segregation between VPI and HSAG's global network.
3. Post-closing governance architecture identified as a subject on which CFIUS will expect a well-developed HSAG proposal at the outset; Treasury signaled receptivity to an SSA-equivalent structure.
4. Treasury did not identify preliminary "showstoppers" and encouraged a July filing on the anticipated schedule.
Action Items.
• Prepare detailed Shanghai disclosure package (assigned: Ashworth / Lohse). Due: July 5.
• Prepare IT segregation plan overview (assigned: HSAG CIO office / Ashworth). Due: July 7.
• Prepare initial governance architecture proposal for inclusion in notice (assigned: Ashworth / Holloway). Due: July 10.
Appendix C: VPI Government Contracts Summary Table
All 14 active contracts, contract numbers, agencies, values, backlog, performance periods, classification levels, and novation-vs.-change-of-name assessment are set forth in the attached workbook (see Exhibit C-1, provided under separate cover). Of the 14 contracts, 8 are identified as requiring formal novation under FAR Subpart 42.12 and 6 are assessed as eligible for change-of-name treatment. Contracting-officer outreach plans and per-contract counsel of record are set forth in Exhibit C-2.
Appendix D: VPI Export-Controlled Items Listing
• ITAR Category XI(a)(3) — Defense articles: GaN HEMT modules and T/R modules qualified for defense radar and missile defense applications.
• EAR ECCN 3A001 — Electronic items: dual-use GaN power amplifier ICs.
• EAR ECCN 3A991 — Dual-use catch-all electronic components.
• EAR ECCN 3E001 — Technology for the development, production, or use of items controlled under 3A001.
• DDTC Registration No. M-24817 — Active since 2011.
• DSP-5 Licenses (3 active) — Detailed license-by-license schedule at Exhibit D-1 (UK: 2 licenses; Australia: 1 license).
Appendix E: Comparable NSA Precedent Summary Table
Cross-reference: Comparative NSA Precedent Analysis Memorandum (Calderwood & Harkness, June 24, 2023). Summary table of key mitigation terms from 12 recent semiconductor-sector NSAs (2019–2023), including board composition, TCP scope, monitor terms and fees, personnel continuity provisions, cybersecurity standards, penalty frameworks, and term/sunset provisions, appears at Exhibit E-1 (provided under separate cover subject to third-party confidentiality restrictions).
— End of Memorandum —
This memorandum has been prepared solely for the addressed recipients in their capacities as officers of Halcyon Semiconductor AG. It reflects the current understanding of Calderwood & Harkness LLP based on facts known as of the date hereof and is subject to change based on further information, additional Committee guidance, or developments in the transaction or its regulatory environment. Nothing herein constitutes an opinion of counsel within the meaning of applicable rules of professional responsibility, and this memorandum should not be relied upon for any purpose other than the internal deliberations of the Vorstand.
TO: | Dr. Maximilian Ehrhardt, CEO (Vorstandsvorsitzender), Halcyon Semiconductor AG
Katarina Brückner, CFO (Finanzvorstand), Halcyon Semiconductor AG
Stefan Lohse, General Counsel (Chefjustitiar), Halcyon Semiconductor AG
FROM: | Beatrice Holloway, Responsible Partner, M&A
Margaret "Peggy" Ashworth, Of Counsel, National Security & CFIUS
Lt. Col. (Ret.) David Caruso, Senior Counsel, Government Contracts & Export Controls
DATE: | June 26, 2023
RE: | CFIUS Risk Assessment and Mitigation Strategy — Acquisition of Marlowe Asset Management Photonics Inc. by Halcyon Semiconductor Aktiengesellschaft
OUR MATTER NO.: | 1032-00004
CFIUS CASE NO.: | To be assigned upon filing (anticipated mid-July 2023)
# | Contract | Prime / Subcontract | Agency | Remaining Backlog
1 | GaN HEMT modules for AN/TPS-80 radar | Prime | U.S. Army CERDEC | $52.3M
2 | Next-gen mmWave power amplifiers | Prime | AFRL | $41.7M
3 | GaN-based T/R modules — missile defense | Prime | MDA | $38.9M
4 | Naval RF subsystems | Sub to Ironclad Defense Systems Inc. | USN NAVSEA | $34.1M
5 | Border surveillance RF components | Prime | DHS S&T | $26.0M
Shareholder | % Ownership
Dr. Nathan Trevorrow and family trusts | 22.4%
Marissa Sung-Avila | 4.1%
Ridgecrest Ventures Fund III, L.P. (GP: Ridgecrest Ventures Management LLC; principal: Franklin Yee) | 31.7%
Cascadian Capital Partners Growth Fund II, L.P. (GP: Cascadian Capital Partners Management LLC; principal: Olivia Hartmann) | 24.3%
Employee option pool (vested/exercised) | 11.8%
Other angel investors | 5.7%
Total | 100.0%
# | Risk Factor | Severity | Primary Concern | Proposed Mitigation | NSA Section (TBD) | HSAG Priority
1 | Foreign Access to Classified Programs | High | Unauthorized foreign access to classified information; espionage risk | SSA-equivalent structure; Security Board Members / GSC; FSO retention; facility access restrictions (Sections C-7 through C-12) | Art. II & Annex A | 1
2 | ITAR/EAR Technology Transfer | High | Deemed-export/deemed-reexport violations; leakage to Shanghai | Technology Control Plan; organizational and IT segregation; pre-authorization protocol; training | Art. III & Annex B (TCP) | 1
3 | Supply Chain / Defense Supply Continuity | High | Disruption to critical defense programs; sole-source concentration | U.S. manufacturing commitment (5-year); personnel continuity; pre-notification of material change; novation support | Art. IV | 1
4 | Cybersecurity | Medium-High | IT integration vectors; foreign network exposure | Physical/logical segregation; NIST SP 800-171; annual pen-test; 72-hour incident reporting; dedicated cyber staff | Art. V & Annex C | 2
5 | FOCI | Medium | Foreign government influence pathway; Shanghai concern | NSA as SSA equivalent; board governance; annual certifications; Shanghai walls | Art. II & VI | 2
6 | Personnel Continuity | Medium-High | Attrition of cleared personnel and key management | 24-month retention (Trevorrow, Sung-Avila, Hendrickson); GSC/DCSA approval for replacements; FSO succession plan | Art. VII | 2
7 | Government Contract / Regulatory Compliance | Medium | Novation delay/failure; ITAR/EAR notification lapses | FAR 42.12 novation support; DFARS 252.209-7002 disclosures; ITAR § 122.4(a) notification; DSP-5 amendments | Art. VIII | 3
Milestone | Estimated Date
Pre-filing consultation with Treasury OIS | Completed June 19, 2023
Draft notice circulated to Committee for informal comment | Early July 2023
Formal filing of voluntary joint notice | Target: July 14, 2023
CFIUS acceptance and commencement of 45-day review | Late July 2023 (approx. July 21–24)
Firs

CALDERWOOD & HARKNESS LLP

M E M O R A N D U M

Record

Parties

Dates

Amounts