Dear Stefan,
I wanted to provide you with a detailed update following Friday's NSA negotiation session. We reached an important milestone: CFIUS has approved the selection of the third-party compliance monitor under the National Security Agreement. This resolves one of the eight priority issues we have been tracking in the NSA negotiation for CFIUS Case No. CFIUS-023-07-3841, and I want to walk you through the details so that you and your team can begin planning accordingly on the operational and budgetary side.
**Approved Monitor**
CFIUS has approved **Whitmore Compliance Group LLC** as the third-party compliance monitor. The firm is led by Gerald Whitmore, a former FBI Counterintelligence Division official who holds an active TS/SCI clearance. Whitmore's offices are located at 1300 Crystal Drive, Suite 710, Arlington, VA 22202.
Whitmore's counterintelligence background and active high-level clearance were decisive factors in securing approval from the monitoring agencies. As you know, DCSA, Treasury, DoD, and DOE collectively required a monitor with demonstrated counterintelligence experience and existing clearances commensurate with VPI's classified programs and the sensitivity of the gallium nitride technology at the heart of this transaction. Whitmore checked all of those boxes, which is why we recommended his firm early in the selection process.
**Scope of Monitoring Obligations**
The agreed monitoring scope encompasses the following:
- **Annual compliance audits** covering the full range of NSA obligations, including: board governance and functioning of the Government Security Committee (GSC); adherence to the Technology Control Plan (TCP); cybersecurity requirements (NIST SP 800-171 compliance, annual penetration testing, and 72-hour incident reporting to DCSA); facility access restrictions, particularly with respect to the Albuquerque fabrication facility clean room Sections C-7 through C-12; data segregation measures (both physical and logical separation of VPI IT systems from the HSAG global network); and personnel continuity obligations (the 24-month minimum retention commitments for Dr. Nathan Trevorrow, Marissa Sung-Avila, and Col. (Ret.) Bryce Hendrickson).
- **Ad hoc reviews** as requested by any of the CFIUS monitoring agencies.
- **Incident investigations** in the event a potential NSA violation is identified.
- All monitor reports will be submitted **directly to the CFIUS monitoring agencies** (DCSA, Treasury, DoD, and DOE).
The first annual compliance audit will be due on the one-year anniversary of NSA execution. If the NSA is executed in January 2024, as currently anticipated, the first audit would accordingly be due in January 2025.
**Cost Structure**
The agreed fee arrangement is as follows:
- **Annual monitoring fee: $1,200,000**, payable quarterly in arrears at **$300,000 per quarter**.
- **CPI adjustment:** The annual fee is subject to adjustment on each anniversary of the NSA's effective date based on the Consumer Price Index for All Urban Consumers (CPI-U). This is a standard provision in comparable NSA monitor engagements.
- **Cost allocation:** CFIUS required that **all monitoring costs be borne entirely by HSAG** as the acquiror. This is consistent with the standard approach in CFIUS mitigation agreements — the rationale being that VPI and its operations should not be burdened with the cost of the acquiror's compliance infrastructure.
- **First quarterly payment:** Due 90 days after the NSA's effective date. If the NSA is executed on or around January 19, 2024, per our current target schedule, the first payment of $300,000 would be due approximately April 19, 2024.
- **Additional costs:** The $1.2 million annual fee covers the core monitoring scope described above. If the CFIUS monitoring agencies request additional ad hoc reviews or investigations beyond the standard annual audit, those may be billed at hourly rates under the monitor engagement agreement. Whitmore has indicated that such requests would be unusual absent a specific triggering event, so we would not expect significant additional costs under normal circumstances.
**Industry Benchmarks**
Peggy Ashworth and I reviewed the $1.2 million annual fee against monitoring costs across comparable semiconductor-sector and defense-technology NSA engagements from 2019 through 2023, drawing on the firm's comparative NSA precedent analysis that we shared with you earlier in this process. Based on that review, the agreed fee is squarely within the observed range. Recent semiconductor and defense-technology CFIUS mitigations have typically carried annual monitor fees of approximately $800,000 to $1.8 million, depending on the scope and complexity of the target company's classified and export-controlled operations.
Given VPI's profile — 212 cleared employees, a facility security clearance at the SECRET level, 14 active DoD contracts with approximately $193 million in backlog, ITAR Category XI(a)(3) defense articles, and EAR ECCN 3A001 dual-use components — a $1.2 million annual fee represents a reasonable mid-range figure. I would also note that the negotiated fee compares favorably to what CFIUS initially contemplated. Early indications from the monitoring agencies suggested a potential scope of review that could have pushed annual costs above $1.5 million. The agreed scope appropriately concentrates monitoring resources on the highest-risk areas — classified programs, technology transfer controls, cybersecurity, and facility access — without duplicating VPI's own internal compliance infrastructure.
**Budget Impact for HSAG**
The monitor fee is an ongoing post-closing obligation and should be incorporated into HSAG's operating budget for VPI. Please note that the $1.2 million per year is incremental to VPI's own internal compliance costs for maintaining NIST SP 800-171 cybersecurity standards, FSO operations, and TCP administration, which will continue as separate line items.
I would recommend that Katarina Brückner's finance team factor the monitor cost into the post-closing integration budgets as soon as practicable. I also want to flag an important point regarding the penalty provisions: under NSA §12.3, failure to make timely monitor payments could constitute a violation of the NSA, subject to civil penalties of up to **$250,000 per violation per day**. It would be prudent to establish the internal payment processes and approvals well in advance of closing so that there is no risk of an inadvertent delay on the first quarterly invoice.
**Next Steps**
We are moving forward on several fronts:
1. We are finalizing a draft **Third-Party Compliance Monitor Agreement** between HSAG and Whitmore Compliance Group LLC. This agreement will formalize the scope of monitoring, fee structure, independence requirements, access rights, reporting obligations, and confidentiality provisions. We expect to circulate a draft to you for review within the next few days.
2. We are preparing the near-final NSA — the third buyer's redline incorporating the agreed monitor terms — for submission to CFIUS shortly thereafter.
3. The remaining open NSA negotiation issues are expected to be resolved at the final session currently scheduled for **December 15, 2023**, with targeted NSA execution in mid-to-late January 2024.
If you or Katarina would like to discuss the cost structure or any other aspect of the monitor arrangement in more detail, I am happy to arrange a call at your convenience. Please do not hesitate to reach out.
Beatrice and Peggy, who are copied here, can of course address any broader questions regarding the NSA negotiation strategy or remaining open issues.
Best regards,
David Caruso Senior Counsel Calderwood & Harkness LLP 1701 Pennsylvania Avenue NW, Suite 800 Washington, DC 20006 Direct: +1 (202) 555-0184 Mobile: +1 (202) 555-0247 d.caruso@calderwoodharkness.com
---
*CONFIDENTIALITY NOTICE: This email and any attachments are intended solely for the use of the individual or entity to whom it is addressed and may contain information that is privileged, confidential, and exempt from disclosure under applicable law, including attorney-client privilege and attorney work product doctrine. If you are not the intended recipient, or the employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this email in error, please notify the sender immediately by reply email and destroy all copies of the original message. Thank you.*