1032-00004 · Client 1032 · Export Control & Government Contracts

ddtc-registration-transfer-memo.docx DOCUMENT M&A / Corporate

27 / 79 ← → ✕

MEMORANDUM

PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION ATTORNEY WORK PRODUCT

TO: Beatrice Holloway, Responsible Partner, Mergers & Acquisitions Margaret "Peggy" Ashworth, Of Counsel, National Security & CFIUS

FROM: Lt. Col. (Ret.) David Caruso, Senior Counsel, Government Contracts & Export Controls Priya Venkataraman, Associate, International Trade & Sanctions

CC: Stefan Lohse, General Counsel, Halcyon Semiconductor AG Christy Bauer, Working Associate, intellectual Property

DATE: August 14, 2023

RE: DDTC Registration Transfer Analysis — Maintenance of Marlowe Asset Management Photonics Inc. ITAR Registration (Registration No. M-24817) Following Acquisition by Halcyon Semiconductor AG

MATTER: Halcyon Semiconductor AG / Marlowe Asset Management Photonics Inc. Acquisition — CFIUS Filing & Mitigation (C&H Matter No. 1032-00004)

CFIUS Case No.: CFIUS-023-07-3841

Right-click to update Table of Contents

I. Executive Summary

This memorandum analyzes the regulatory requirements for maintaining Marlowe Asset Management Photonics Inc.'s ("VPI") registration with the Directorate of Defense Trade Controls ("DDTC"), U.S. Department of State, following the proposed acquisition of 100% of VPI's outstanding equity by Halcyon US Holdings Inc. ("Halcyon US"), a Delaware C-corporation that is wholly owned by Halcyon Semiconductor Aktiengesellschaft ("HSAG"), a German public company listed on the Frankfurt Stock Exchange (XETRA: HLC). The analysis addresses the applicable International Traffic in Arms Regulations ("ITAR") requirements, the interaction between the DDTC notification obligations and the ongoing Committee on Foreign Investment in the United States ("CFIUS") review and anticipated National Security Agreement ("NSA"), and the recommended timeline for completing all necessary regulatory filings.

Key Conclusion. VPI's DDTC registration (Registration No. M-24817) must be maintained without interruption following the closing of the transaction. The change in ownership of VPI from its current shareholders to Halcyon US (and, through Halcyon US, to HSAG) triggers mandatory notification and amendment obligations under ITAR § 122.4(a) (22 C.F.R. § 122.4(a)). Failure to properly and timely notify DDTC of the ownership change could result in revocation of VPI's registration and the consequent loss of VPI's authority to manufacture and export defense articles classified under the United States Munitions List ("USML"). Such an outcome would be catastrophic to VPI's ongoing business operations and government contract performance, and would constitute a material adverse effect under the Stock Purchase Agreement. Accordingly, strict compliance with the ITAR notification requirements is both a regulatory imperative and a commercial necessity.

VPI has been registered with DDTC continuously since 2011. During this period, VPI has developed a significant defense business centered on the design and manufacture of advanced gallium-nitride ("GaN") power amplifier chips and high-electron-mobility transistor ("HEMT") components. These products are classified as defense articles under ITAR Category XI(a)(3) of the USML — electronic equipment and components specifically designed, modified, or configured for military applications, including defense radar and satellite communications systems. VPI's DDTC registration is the foundational authorization enabling VPI to engage in this business.

VPI currently holds three (3) active DSP-5 export licenses authorizing deliveries of defense articles to the United Kingdom and Australia, both NATO allies or close defense cooperation partners of the United States. The impact of the ownership change on these DSP-5 licenses is addressed separately in the companion memorandum titled DSP-5 License Continuation Memorandum (C&H Matter No. 1032-00004, Sub-File 4B), which should be read in conjunction with this analysis.

This memorandum also addresses the critical coordination between the DDTC notification process and the National Security Agreement currently being negotiated with CFIUS, with particular focus on the Technology Control Plan ("TCP") provisions that will be set forth in the NSA's Annex B. The TCP provisions are expected to establish the compliance framework that will govern VPI's handling of ITAR-controlled technical data and defense articles in the post-closing environment, and they will serve as the primary basis for DDTC's assessment of whether continued registration under foreign ownership is appropriate. Coordination of the DDTC notification with the NSA framework is therefore essential to presenting a unified and compliance picture to the U.S. government.

The closing of the acquisition is currently targeted for early 2024, following the completion of the CFIUS review and the execution of the NSA. The DDTC notification should be prepared in draft form well in advance of closing so that it can be filed promptly — within five (5) business days of the closing date — in compliance with the regulatory timeline.

II. Background

A. The Transaction

Halcyon Semiconductor AG ("HSAG"), a German Aktiengesellschaft (public stock corporation) headquartered at Industriestraße 44, 01099 Dresden, Saxony, Federal Republic of Germany, is acquiring 100% of the outstanding equity of Marlowe Asset Management Photonics Inc. ("VPI"), a Delaware C-corporation incorporated on February 14, 2009, and headquartered at 7400 Ridgeline Parkway, Colorado Springs, Colorado 80919. The acquisition is being effectuated through a wholly owned acquisition vehicle, Halcyon US Holdings Inc. ("Halcyon US"), a Delaware corporation formed on June 5, 2023, with a registered agent located at 160 Greentree Drive, Suite 101, Dover, Delaware 19904 (EIN: 93-2841067). Halcyon US was formed as a single-purpose entity for the purpose of holding HSAG's equity interest in VPI and serving as the direct parent of VPI in the post-closing corporate structure.

The Stock Purchase Agreement ("SPA") was executed on June 10, 2023. The base purchase price is $1.42 billion on an all-cash, cash-free, debt-free basis, with a normalized net working capital target of $34.6 million. An earnout provision provides for additional contingent consideration of up to $85 million based on achievement of specified revenue and contract backlog milestones during the 24-month period following closing, resulting in a maximum aggregate consideration of $1.505 billion.

The transaction is structured as a 100% equity acquisition. VPI will continue as a going concern following the closing and will operate as a wholly owned subsidiary of Halcyon US. VPI will retain its separate legal identity as a Delaware corporation, its own management team, its existing facilities, and its existing government contracts and security clearances. This structural continuity is a critical element both for the CFIUS mitigation framework and for the DDTC registration maintenance analysis set forth in this memorandum.

The SPA contains customary conditions to closing, including, among others: (i) receipt of CFIUS clearance (either express approval or expiration of the applicable review/investigation period without action), (ii) expiration or termination of the applicable waiting period under the Hart-Scott-Rodino Antitrust Improvements Act of 1976, (iii) receipt of applicable foreign regulatory approvals (including the German Federal Ministry for Economic Affairs and Climate Action under the Foreign Trade and Payments Act (Außenwirtschaftsgesetz)), and (iv) absence of any material adverse effect. The SPA does not separately condition closing on DDTC approval of the ownership change notification, though it does contain a covenant requiring the parties to use commercially reasonable efforts to maintain VPI's material governmental authorizations, including its DDTC registration.

B. VPI's DDTC Registration and ITAR-Controlled Activities

VPI has been registered with DDTC continuously since 2011 under Registration No. M-24817. The registration has been renewed without interruption during this period, and VPI is currently in good standing with DDTC. There are no pending enforcement actions, compliance inquiries, or voluntary disclosures involving VPI before DDTC as of the date of this memorandum.

VPI's core business consists of the design and manufacture of advanced GaN-on-silicon carbide ("GaN-on-SiC") power amplifier chips and high-electron-mobility transistor ("HEMT") components. These products represent a critical enabling technology for defense radar systems, satellite communications platforms, electronic warfare systems, and related military applications. VPI is one of a limited number of domestic suppliers with the capability to fabricate GaN-on-SiC components at the performance levels and reliability standards required by the U.S. Department of Defense ("DoD") and its allied counterparts.

VPI's principal defense products are classified as defense articles under ITAR Category XI(a)(3) of the United States Munitions List (22 C.F.R. § 121.1), which covers electronic equipment, including but not limited to electronic countermeasure and counter-countermeasure equipment, radar equipment, and electronic components specifically designed, modified, or configured for military applications. In addition to its ITAR-controlled products, VPI manufactures certain dual-use components that are classified under the Export Administration Regulations ("EAR") under Export Control Classification Numbers ("ECCNs") 3A001 (electronic components), 3A991 (electronic devices and components not controlled by 3A001), and 3E001 (technology for the development or production of commodities controlled by 3A001). The interplay between ITAR and EAR classifications is addressed separately in the companion ITAR/EAR Classification Review Memorandum prepared by Christy Bauer, which identifies six (6) items requiring reclassification review in connection with the post-closing compliance program.

VPI's manufacturing operations are conducted at its fabrication facility located at 9200 Innovation Boulevard, Albuquerque, New Mexico 87113. This facility comprises approximately 45,000 square feet of GaN-on-SiC fabrication capacity and maintains a Facility Security Clearance ("FCL") up to the SECRET level, assigned CAGE Code 7VK92. The facility is equipped with specialized manufacturing equipment for epitaxial growth, photolithography, etching, metallization, and wafer-level testing of GaN-on-SiC devices. The facility's FCL is essential for VPI's performance of classified government contracts and is maintained under the oversight of the Defense Counterintelligence and Security Agency ("DCSA"), as discussed further in Section VII.B below.

VPI's DUNS Number is 07-812-4493, and its Employer Identification Number (EIN) is 26-4371885. These identifiers are associated with VPI's registrations in the System for Award Management ("SAM"), DDTC's registration system, and the DCSA National Industrial Security Program ("NISP") records.

VPI currently holds three (3) active DSP-5 export licenses authorizing the permanent export of specified ITAR Category XI(a)(3) defense articles to end users in the United Kingdom and Australia. These licenses support deliveries under cooperative defense programs with these NATO and allied nations. The status and required amendments of these licenses are addressed in the companion DSP-5 License Continuation Memorandum.

VPI maintains fourteen (14) active contracts with the U.S. Department of Defense, consisting of both prime contracts and subcontracts. The aggregate backlog under these contracts is approximately $193 million as of the most recent quarterly reporting period. These contracts span multiple DoD agencies and programs, including contracts with the Defense Advanced Research Projects Agency ("DARPA"), the U.S. Air Force Research Laboratory ("AFRL"), the Missile Defense Agency ("MDA"), and several classified programs. The continuation of VPI's DDTC registration is a contractual requirement under a number of these agreements, and loss of registration would constitute a material breach or default event under the applicable contract terms.

Of VPI's 486 total employees, 212 hold active U.S. government security clearances at various levels. Colonel (Ret.) Bryce Hendrickson serves as VPI's Vice President, Government Programs, and Facility Security Officer ("FSO"). Col. Hendrickson holds an active TS/SCI clearance and has served in the FSO role since 2016. He is the primary point of contact for VPI's interactions with DCSA, DDTC, and contracting officers on matters relating to security clearances, ITAR compliance, and classified program management. His continuation in these roles post-closing is a key element of the overall compliance and regulatory continuity strategy.

C. HSAG Overview

HSAG is a German Aktiengesellschaft (public stock corporation) organized under the laws of the Federal Republic of Germany and commercially registered as HRB 28416 with the Amtsgericht (District Court) Dresden. HSAG's Legal Entity Identifier (LEI) is 5299007KXQ2M4GHILZ38. As of June 1, 2023, HSAG's market capitalization was approximately €14.8 billion. For fiscal year 2022, HSAG reported consolidated revenues of €6.12 billion and earnings before interest, taxes, depreciation, and amortization ("EBITDA") of €1.37 billion.

HSAG is a global semiconductor company with principal operations in Germany, the European Union, and Asia. HSAG's product portfolio includes power semiconductors, sensors, microcontrollers, and related electronic components for automotive, industrial, and consumer applications. While HSAG has extensive experience in semiconductor manufacturing, it does not currently manufacture or export ITAR-controlled defense articles and is not registered with DDTC. HSAG's acquisition of VPI represents its first significant entry into the U.S. defense semiconductor market.

HSAG maintains existing U.S. operations through Halcyon US Inc., a Delaware corporation located at 11501 Alterra Parkway, Suite 300, Austin, Texas 78758 (EIN: 81-3056429). Halcyon US Inc. is a fabless design center employing approximately 320 persons, focused on analog and mixed-signal integrated circuit design for commercial automotive and industrial applications. Halcyon US Inc. does not perform any classified work, does not hold a DDTC registration, and does not engage in any ITAR-controlled activities. It is important to note that Halcyon US Inc. (the existing Austin entity) is distinct from Halcyon US Holdings Inc. (the newly formed Delaware acquisition vehicle). Post-closing, VPI will be a subsidiary of Halcyon US Holdings Inc., not of Halcyon US Inc.

HSAG's Chief Executive Officer is Dr. Maximilian Ehrhardt, a German citizen who does not hold a U.S. security clearance. HSAG's General Counsel is Stefan Lohse, LL.M. (Georgetown University), who is admitted to practice law in both the State of New York and the Federal Republic of Germany and holds dual German and U.S. citizenship. Mr. Lohse is copied on this memorandum in his capacity as HSAG's General Counsel and the primary HSAG-side counterpart for the regulatory compliance workstreams addressed herein.

HSAG is not currently a registrant with DDTC and does not manufacture or export ITAR-controlled defense articles. This fact is significant for the DDTC notification analysis because DDTC will assess the foreign parent's profile and history in evaluating the continued registration application. While HSAG has no ITAR track record, its position as a major European semiconductor manufacturer headquartered in a NATO ally country, and the comprehensive mitigation framework established through the CFIUS NSA, are expected to provide a sufficient basis for DDTC's approval of continued registration.

D. Existing VPI Shareholders (Pre-Closing)

VPI's outstanding equity is currently held by the following shareholders, all of whom will be selling their entire equity interests in connection with the transaction:

It is noteworthy that the two institutional investors — Ridgecrest Ventures Fund III, L.P. and Cascadian Capital Partners Growth Fund II, L.P. — are U.S.-based venture capital and growth equity funds. Neither fund is affiliated with any foreign person, and neither fund's involvement has previously triggered any FOCI considerations. The transition from domestic private ownership to foreign ownership through HSAG is what necessitates the heightened regulatory analysis set forth in this memorandum.

Dr. Trevorrow and Ms. Sung-Avila are expected to remain in their current executive roles for a minimum of 24 months post-closing under the terms of the NSA, as discussed further in Section VIII below. Their continued leadership provides important continuity for both ITAR compliance and the broader defense business.

III. ITAR Registration Requirements — Legal Framework

A. Overview of ITAR Registration Under 22 C.F.R. Part 122

The International Traffic in Arms Regulations, codified at 22 C.F.R. Parts 120–130, implement the Arms Export Control Act ("AECA"), 22 U.S.C. §§ 2751 et seq., and govern the export and temporary import of defense articles and defense services, as well as the brokering of defense articles. Part 122 of the ITAR establishes the registration requirements that apply to any person who engages in the United States in the business of manufacturing, exporting, or temporarily importing defense articles, or furnishing defense services.

Specifically, ITAR § 122.1(a) provides that any person who engages in the United States in the business of either manufacturing or exporting defense articles or furnishing defense services is required to register with DDTC. Registration is not merely an administrative formality; it is a jurisdictional prerequisite for any export or manufacturing authorization. A person who is not registered with DDTC may not apply for or receive export licenses (including DSP-5, DSP-73, or DSP-85 licenses), may not utilize license exemptions under ITAR Part 126, and may not manufacture defense articles for sale or export. In practical terms, loss of registration would preclude VPI from performing on its existing government contracts that involve the manufacture, sale, or delivery of ITAR-controlled defense articles. Given that VPI's defense contracts represent a substantial majority of VPI's revenue and constitute the core of its business value, the maintenance of DDTC registration is, by any measure, essential to VPI's viability as a going concern and to the value of the acquisition to HSAG.

The registration period under DDTC's current practice is typically annual, although DDTC has at various times permitted multi-year registrations. Registrants are required to submit renewal applications in advance of the expiration of their registration period, together with the applicable registration fee. VPI's registration has been continuously maintained since its initial registration in 2011, reflecting an unbroken twelve-year compliance history. This track record of responsible DDTC registration and compliance is a positive factor that should be emphasized in the change-of-ownership notification.

DDTC's registration system also requires registrants to maintain accurate and current information on file, including information regarding the registrant's legal name, address, organizational structure, officers, and the nature of its defense article manufacturing and export activities. The obligation to update this information in connection with material changes — including, critically, changes in ownership — is the subject of ITAR § 122.4(a), which is the operative regulatory provision for the analysis in this memorandum.

B. ITAR § 122.4(a) — Notification of Changes in Registration Information

Section 122.4(a) of the ITAR (22 C.F.R. § 122.4(a)) imposes an affirmative obligation on DDTC registrants to notify DDTC of any material change in the information previously provided at the time of registration or in connection with the most recent registration renewal. The regulation provides, in relevant part, that a registrant must notify DDTC of any change that is material to the registration, and specifically identifies changes in ownership or control as material changes requiring notification.

The acquisition of 100% of VPI's outstanding equity by Halcyon US Holdings Inc. — and the resulting indirect ownership of VPI by HSAG, a foreign person organized under the laws of Germany — is a paradigmatic change-of-ownership event that triggers the notification requirement under ITAR § 122.4(a). The change is material not only because VPI's shareholder composition will change entirely, but because the new ultimate parent entity is a foreign person, which introduces foreign ownership, control, or influence ("FOCI") considerations that did not exist under VPI's prior ownership structure.

The notification must be submitted in writing to DDTC's Office of Defense Trade Controls Management ("DTCM"). While DDTC has at times accepted electronic filings for certain routine updates, it is our practice — and our recommendation — that a change-of-ownership notification of this significance be submitted formally in writing, with supporting documentation, to the DTCM Director. A cover letter from VPI's designated ITAR compliance officer (Col. (Ret.) Bryce Hendrickson) should accompany the notification, together with the supporting materials described in Section III.D below.

It is important to emphasize, for the benefit of all parties and their respective counsel, that the ITAR § 122.4(a) notification obligation is distinct from and independent of the CFIUS filing and clearance process. Compliance with CFIUS — including the execution and implementation of a National Security Agreement — does not substitute for, satisfy, or in any way discharge the separate ITAR notification obligation. While the CFIUS and ITAR processes are related, and while the mitigation measures adopted through the CFIUS process will be highly relevant to DDTC's evaluation of the ownership change, each regulatory regime imposes its own independent requirements. Failure to satisfy the ITAR notification requirement, even in circumstances where CFIUS clearance has been obtained, could result in an independent violation of the ITAR.

C. Timing of Notification

ITAR § 122.4(a) requires that the notification of a material change be submitted within a specified period following the effective date of the change. DDTC's current guidance and practice establish a notification window of five (5) business days from the date the change becomes effective — that is, five business days from the date of closing. Given that the transaction closing is currently targeted for February 9, 2024 (a Friday), the notification deadline would be approximately February 16, 2024 (the following Friday, assuming no intervening federal holidays).

As a matter of best practice, and in light of the significance and complexity of this particular ownership change, we strongly recommend that the notification be prepared in final draft form well in advance of closing. Ideally, the notification letter and all supporting documentation should be substantially complete no later than January 31, 2024, such that they can be reviewed and approved by the relevant stakeholders and filed immediately upon closing. Prompt filing — on the day of closing or the first business day thereafter — demonstrates good faith compliance and minimizes the risk of any gap in VPI's registration status.

In addition to the post-closing notification, we recommend that VPI and Halcyon US engage in pre-notification or advance engagement with DDTC prior to closing. This is standard practice for significant ownership changes, particularly those involving foreign acquirors. Advance engagement allows the parties to alert DDTC to the forthcoming change, to preview the anticipated notification content, and to address any preliminary questions or concerns that DDTC may have. This approach reduces the likelihood of unexpected issues arising after the notification is filed and facilitates a smoother review process. The advance engagement can be conducted informally, through a meeting or telephone call between VPI's ITAR compliance officer and the DTCM Director, or more formally through a pre-notification letter.

Given that CFIUS clearance is a condition to closing under the SPA, the DDTC notification timing should be carefully coordinated with the CFIUS clearance timeline. The CFIUS review is currently in the investigation phase (the 45-day investigation period commenced on July 24, 2023), and the parties anticipate that the NSA negotiations may extend into Q4 2023 or Q1 2024. The DDTC notification cannot be filed until closing occurs, but the advance preparation and pre-notification engagement can and should proceed in parallel with the CFIUS process.

D. Content of the ITAR § 122.4(a) Notification

The ITAR § 122.4(a) notification should include the following information, at a minimum, to provide DDTC with a comprehensive picture of the ownership change and the measures being taken to ensure continued ITAR compliance:

(a) Registrant Information. Full legal name and address of VPI (Marlowe Asset Management Photonics Inc., 7400 Ridgeline Parkway, Colorado Springs, CO 80919), together with VPI's DDTC Registration Number (M-24817), DUNS Number (07-812-4493), EIN (26-4371885), and CAGE Code (7VK92).

(b) New Owner Information. Full legal name and address of the direct new owner (Halcyon US Holdings Inc., 160 Greentree Drive, Suite 101, Dover, DE 19904; EIN: 93-2841067) and the ultimate foreign parent entity (Halcyon Semiconductor AG, Industriestraße 44, 01099 Dresden, Saxony, Germany; commercial registration: HRB 28416, Amtsgericht Dresden; LEI: 5299007KXQ2M4GHILZ38).

(c) Description of the Change. A clear description of the change in ownership, including the fact that 100% of VPI's outstanding equity has been acquired by Halcyon US Holdings Inc., a newly formed Delaware corporation that is a wholly owned subsidiary of HSAG.

(d) Identification of the Foreign Parent Entity. Express identification of HSAG as a foreign person (a German Aktiengesellschaft), including its country of organization, principal place of business, and the nature of its business operations.

(e) Continuing Entity Status. Confirmation that VPI will continue to operate as a separate legal entity incorporated under the laws of the State of Delaware, with its own management, employees, facilities, and ITAR-controlled operations.

(f) Continuing Officers. Identification of VPI's continuing officers responsible for ITAR compliance, including: Dr. Nathan Trevorrow (CEO), who holds a TS/SCI clearance; Marissa Sung-Avila (President and COO), who holds a SECRET clearance; and Colonel (Ret.) Bryce Hendrickson (VP Government Programs and FSO), who holds a TS/SCI clearance and serves as VPI's primary ITAR compliance officer and DDTC point of contact.

(g) Continuing ITAR Activities. A statement describing VPI's continuing ITAR-controlled activities and product classifications, including the manufacture and export of defense articles classified under ITAR Category XI(a)(3) of the USML.

(h) CFIUS NSA Reference. Reference to the executed CFIUS National Security Agreement (anticipated to be designated NSA-2024-0019), including a summary of the key mitigation measures relevant to ITAR compliance — specifically, the Technology Control Plan (TCP) provisions, the Government Security Committee (GSC) structure, the continuing FCL, and the appointment of the third-party compliance monitor.

(i) FOCI Mitigation. Updated information regarding the foreign ownership, control, or influence (FOCI) arrangements applicable to VPI, including the NSA's function as a Special Security Agreement (SSA) equivalent for purposes of VPI's FCL, and the DCSA oversight mechanisms.

(j) Organizational Chart. An updated organizational chart reflecting the post-closing corporate structure: HSAG → Halcyon US Holdings Inc. → VPI.

The notification should be accompanied by relevant supporting documentation, including copies of (or references to) the executed NSA, the TCP, and the post-closing organizational chart. We recommend that the notification letter be signed by Col. (Ret.) Bryce Hendrickson in his capacity as VPI's VP Government Programs and FSO, with a countersignature or acknowledgment from Dr. Nathan Trevorrow as CEO.

IV. Foreign Ownership Considerations Under ITAR

A. ITAR § 120.15 — Definition of "Foreign Person"

The ITAR defines "foreign person" at 22 C.F.R. § 120.15 to include, among others, any corporation or other entity organized under the laws of a foreign country. HSAG, as a corporation organized under the laws of the Federal Republic of Germany, is unambiguously a "foreign person" within the meaning of the ITAR. This classification applies to HSAG regardless of its status as a publicly traded company, its commercial relationship with U.S. entities, or its status as a corporation of a NATO ally.

Following the closing of the transaction, VPI will be owned by a foreign person through the following corporate chain: HSAG (German Aktiengesellschaft) → Halcyon US Holdings Inc. (Delaware corporation) → VPI (Delaware corporation). While VPI itself will remain a U.S. entity organized under the laws of Delaware, its ultimate beneficial ownership will rest with a foreign person. This ownership structure has significant implications for VPI's DDTC registration, its handling of ITAR-controlled defense articles and technical data, and its eligibility to participate in classified government programs.

It is important to note, however, that the interposition of Halcyon US Holdings Inc. — a U.S.-organized entity — between HSAG and VPI does not alter the fundamental foreign ownership analysis. DDTC and other U.S. government agencies routinely look through intermediate holding entities to identify the ultimate beneficial owner. HSAG's indirect ownership of VPI through a Delaware holding company does not alter HSAG's status as a foreign person or diminish the foreign ownership implications of the transaction.

The classification of HSAG as a foreign person does not automatically disqualify VPI from maintaining its DDTC registration, but it does trigger heightened scrutiny and additional compliance obligations, as discussed in the following subsections. The practical impact of the foreign ownership classification is that DDTC will evaluate the ownership change through the lens of whether adequate safeguards are in place to prevent the unauthorized diversion of defense articles, defense services, or ITAR-controlled technical data to foreign persons, including to HSAG and its non-U.S. personnel.

B. Impact of Foreign Ownership on DDTC Registration

DDTC does not categorically prohibit ITAR registration by U.S. subsidiaries of foreign persons. There are numerous U.S. companies that maintain active DDTC registrations while being wholly owned by foreign parent entities, including parent entities organized in NATO ally countries and other close defense cooperation partners. The defense industrial base of the United States includes a significant number of foreign-owned, domestically controlled ("FODC") companies that play important roles in defense production and supply chains. DDTC's registration framework accommodates these companies, subject to appropriate safeguards.

However, DDTC will scrutinize the ownership change to assess whether the foreign ownership structure creates an unacceptable risk of diversion of defense articles or technical data to unauthorized foreign persons. This assessment will consider a number of factors, including but not limited to:

(i) the country of organization and principal place of business of the foreign parent entity, and the relationship between that country and the United States in defense and security matters;

(ii) the nature and sensitivity of the defense articles manufactured or exported by the registrant;

(iii) the adequacy of the safeguards in place to prevent unauthorized access by foreign persons to ITAR-controlled items and technical data;

(iv) the registrant's compliance history and the qualifications and experience of its ITAR compliance personnel;

(v) the existence of any U.S. government-approved mitigation framework, such as a CFIUS National Security Agreement or a DCSA-approved FOCI mitigation arrangement;

(vi) the registrant's facility security clearance status and the measures in place to protect classified information; and

(vii) any other factors that DDTC deems relevant to the assessment of risk.

In VPI's case, several of these factors weigh strongly in favor of continued registration. Germany is a NATO ally and one of the United States' closest defense cooperation partners, with extensive government-to-government defense trade relationships and a robust export control regime of its own. HSAG is a well-established, publicly traded company with no history of export control violations or sanctions issues. VPI's management team — including its CEO, COO, and FSO — will remain in place post-closing, providing continuity in ITAR compliance oversight. And the NSA negotiated through the CFIUS process will establish a comprehensive, U.S. government-approved mitigation framework specifically designed to address the risks associated with foreign ownership.

Notwithstanding these favorable factors, DDTC retains discretion to condition continued registration on the implementation of additional safeguards or to impose specific restrictions on VPI's activities. The potential conditions and restrictions are discussed in the following subsection.

C. Potential DDTC Conditions or Restrictions

Based on our experience with prior DDTC change-of-ownership reviews involving foreign acquirors, DDTC may impose one or more of the following conditions on VPI's continued registration:

(i) U.S. Citizen Empowered Officer. DDTC may require VPI to designate a U.S. citizen as the empowered officer responsible for overseeing all ITAR compliance activities, with authority to sign export license applications, approve transfers of technical data, and ensure compliance with all ITAR requirements. This role is currently performed by Col. (Ret.) Bryce Hendrickson, who is a U.S. citizen. The NSA's requirement that key ITAR compliance personnel be U.S. citizens aligns with this expected DDTC condition.

(ii) Enhanced Internal Compliance Program. DDTC may require VPI to implement an enhanced internal compliance program that goes beyond the standard ITAR compliance requirements, including more frequent training, additional record-keeping, and enhanced monitoring of technical data access. The TCP provisions of the NSA are expected to address these requirements in substantial detail.

(iii) Restrictions on Foreign Person Access. DDTC may impose explicit restrictions prohibiting non-U.S. persons — including HSAG personnel — from accessing ITAR-controlled technical data or defense articles without prior U.S. government authorization (i.e., an approved export license or applicable exemption). This restriction is fully consistent with the TCP's prohibition on the transfer of ITAR-controlled technical data to non-U.S. persons.

(iv) Periodic Reporting. DDTC may require VPI to submit periodic reports (e.g., annually or semi-annually) to DDTC summarizing VPI's ITAR compliance activities, any changes in personnel or organizational structure, and any incidents or potential violations. These reporting obligations can be coordinated with the annual compliance audits required under the NSA.

We anticipate that any conditions imposed by DDTC will be substantially aligned with the provisions of the NSA's Technology Control Plan, given that the TCP is being negotiated with the active participation of the Department of Defense and is designed to address precisely the same foreign ownership risks that DDTC will evaluate. To the extent that DDTC and the CFIUS monitoring agencies (principally DCSA) coordinate their oversight activities — which is the norm in cases involving DDTC registrants subject to NSAs — the conditions imposed by each agency should be harmonized to minimize duplicative or conflicting obligations on VPI. We will work to ensure this coordination through our advance engagement with DDTC and through dialogue with DCSA during the NSA negotiation process.

V. Coordination with the National Security Agreement and Technology Control Plan

A. NSA Framework (NSA-2024-0019)

The National Security Agreement, which is currently being negotiated between the transaction parties (HSAG, Halcyon US Holdings Inc., and VPI) and the U.S. Government (represented by the Departments of the Treasury, Defense, and Energy), is expected to be executed on or about January 19, 2024, and is anticipated to be designated as NSA-2024-0019. The NSA establishes comprehensive mitigation measures designed to address the national security risks identified by CFIUS in connection with the acquisition. These measures are tailored to the specific circumstances of VPI's business, including its DDTC registration, its ITAR-controlled activities, its classified government contracts, and its Facility Security Clearance.

The NSA functions as a Special Security Agreement ("SSA") equivalent for purposes of VPI's Facility Security Clearance under the National Industrial Security Program Operating Manual ("NISPOM"). The SSA-equivalent framework allows VPI to maintain its FCL at the SECRET level notwithstanding the foreign ownership by HSAG, subject to the implementation of specified FOCI mitigation measures. This is a critical element of the overall regulatory architecture, because VPI's FCL is required for the performance of its classified government contracts, which in turn depend on VPI's DDTC registration for the export and manufacture of ITAR-controlled defense articles.

The monitoring agency under the NSA is the Defense Counterintelligence and Security Agency ("DCSA"), which is also the cognizant security agency responsible for VPI's FCL under the NISPOM. DCSA's dual role as both the NSA monitoring agency and the FCL cognizant security agency provides a unified oversight framework that should give DDTC additional confidence in the effectiveness of the post-closing compliance structure.

In addition to DCSA oversight, the NSA requires the appointment of a third-party compliance monitor. The parties have selected Whitmore Compliance Group LLC to serve in this role. The principal of Whitmore Compliance Group is Gerald Whitmore, a former supervisory special agent with the FBI's Counterintelligence Division with over 25 years of experience in counterintelligence investigations and FOCI mitigation. Whitmore Compliance Group's offices are located at 1300 Crystal Drive, Suite 710, Arlington, Virginia 22202. The annual monitoring fee is $1.2 million per annum, payable in quarterly installments of $300,000, with all costs borne by HSAG. The compliance monitor will conduct periodic assessments of VPI's compliance with the NSA and TCP provisions, including compliance with ITAR requirements, and will submit reports to DCSA and the CFIUS monitoring agencies.

B. Technology Control Plan (TCP) — NSA Annex B

The Technology Control Plan, which will be set forth in Annex B to the NSA, is the core compliance framework governing VPI's handling of controlled technical data and defense articles in the post-closing environment. The TCP is designed to ensure that no ITAR-controlled or EAR-controlled technical data or defense articles are transferred to any non-U.S. person — including HSAG and its personnel — without prior authorization from the U.S. government. The TCP's provisions are directly relevant to DDTC's evaluation of VPI's continued registration and are expected to satisfy DDTC's requirements for adequate safeguards under foreign ownership.

The key TCP provisions relevant to the ITAR registration analysis include the following:

(a) Prohibition on Unauthorized Transfer. The TCP categorically prohibits the transfer of VPI technical data that is controlled under the ITAR or EAR to any non-U.S. person without prior authorization from the applicable U.S. government agency (DDTC for ITAR-controlled data, the Bureau of Industry and Security for EAR-controlled data). This prohibition applies to all forms of transfer, including oral, written, electronic, and visual disclosures.

(b) Exclusion of HSAG Personnel. HSAG personnel who are non-U.S. persons may not access ITAR Category XI(a)(3) defense articles or related technical data absent specific, case-by-case authorization from the U.S. government. This restriction applies regardless of the HSAG personnel's corporate role, seniority, or security clearance status (if any) in their home country. The restriction is enforced through physical and logical access controls, including badge access restrictions, network segmentation, and clean-desk policies.

(c) Information-Sharing Procedures. The TCP establishes carefully delineated procedures for sharing certain categories of business information between VPI and HSAG for legitimate business purposes (e.g., financial reporting, human resources administration, and non-technical commercial operations), while ensuring that controlled technical data is not included in or accessible through such information-sharing channels. These procedures include the use of designated review officers at VPI who screen all outbound communications to HSAG for controlled content.

(d) IT System Separation. VPI's information technology systems must be physically and logically separated from HSAG's global corporate network. No shared cloud infrastructure, shared servers, shared email systems, or shared collaboration platforms may be used for VPI's ITAR-controlled operations. VPI must maintain its own independent IT infrastructure, with access controls that prevent any non-U.S. person from accessing systems containing controlled technical data. This requirement extends to any third-party IT service providers, who must be U.S. persons and must hold appropriate security clearances if accessing classified data.

(e) Personnel Training and Certification. All VPI personnel with access to ITAR-controlled technical data or defense articles must receive initial and annual refresher training on the TCP requirements, including the restrictions on disclosure to non-U.S. persons. Personnel must certify their understanding and compliance with these requirements.

These TCP provisions provide a robust and detailed framework that directly addresses the concerns that DDTC would be expected to raise in evaluating VPI's continued registration under foreign ownership. By implementing the TCP, VPI will maintain the functional separation between its ITAR-controlled activities and HSAG's foreign operations that is necessary to prevent unauthorized access or diversion.

C. Cross-Reference Strategy

We recommend that the DDTC change-of-ownership notification filed under ITAR § 122.4(a) expressly reference the NSA (NSA-2024-0019) and the TCP (NSA Annex B) as the comprehensive framework for ensuring that ITAR compliance is maintained in the post-closing environment. This cross-referencing strategy serves several important purposes.

First, it demonstrates to DDTC that the foreign ownership risks associated with the HSAG acquisition have been thoroughly reviewed and addressed by the U.S. government through the CFIUS process, involving the Departments of the Treasury, Defense, and Energy. The fact that multiple U.S. government agencies have participated in the development and approval of the mitigation measures should carry significant weight with DDTC.

Second, the cross-reference allows VPI to present a unified and compliance picture, rather than requiring DDTC to evaluate VPI's continued registration in isolation from the broader regulatory framework. DDTC is aware that companies subject to CFIUS NSAs operate under comprehensive compliance frameworks, and the reference to the NSA provides DDTC with the full context necessary to assess the adequacy of the safeguards in place.

Third, DCSA's role as the monitoring agency under the NSA provides DDTC with ongoing assurance of compliance. DCSA already has oversight responsibility for VPI's Facility Security Clearance and is familiar with VPI's operations. The expansion of DCSA's monitoring role to encompass the NSA provisions, including the ITAR-related TCP requirements, creates a built-in compliance verification mechanism that should give DDTC confidence that the safeguards will be effectively implemented and maintained over time.

Fourth, the annual compliance audits conducted by Whitmore Compliance Group LLC will encompass ITAR compliance as part of the overall NSA compliance reporting. The results of these audits can be made available to DDTC upon request, providing an independent, third-party verification of VPI's ITAR compliance status. We recommend that the notification letter expressly offer to provide DDTC with copies of the annual compliance audit reports, subject to any applicable confidentiality restrictions.

D. Board Governance and Government Security Committee

The post-closing board governance structure established under the NSA provides an additional layer of oversight over VPI's ITAR-controlled activities that should be highlighted in the DDTC notification.

VPI's post-closing board of directors will consist of five (5) members, structured as follows:

(a) Three (3) Security Board Members — U.S. citizens who hold or are eligible to hold security clearances at the TS/SCI level, including at least one independent Security Director who is not affiliated with either VPI or HSAG. The Security Board Members are responsible for overseeing all aspects of VPI's classified and ITAR-controlled operations.

(b) Two (2) HSAG Designees — Representatives designated by HSAG who may participate in VPI board meetings and have access to non-controlled business information, but who may not hold or access classified information or ITAR-controlled technical data.

The three Security Board Members will constitute the Government Security Committee ("GSC"), which will have exclusive authority over the following matters:

(i) All classified and ITAR-controlled programs, contracts, and activities;

(ii) All personnel security matters, including the granting, denying, and revoking of security clearances;

(iii) All facility security matters, including the maintenance and administration of VPI's FCL;

(iv) All ITAR compliance matters, including the appointment and removal of ITAR compliance officers, the approval of export license applications, and the oversight of the Technology Control Plan; and

(v) All interactions with DDTC, DCSA, and other U.S. government agencies regarding classified, export-controlled, or national security matters.

The GSC's exclusive authority over ITAR-controlled activities ensures that foreign ownership does not translate into foreign control or influence over VPI's defense-related operations. This governance structure is a well-established element of FOCI mitigation and is recognized by both DCSA and DDTC as an effective mechanism for protecting national security interests while permitting foreign investment in the U.S. defense industrial base. The DDTC notification should describe the GSC structure and its authority in detail, as this governance mechanism directly addresses DDTC's core concern regarding foreign person access to and influence over ITAR-controlled activities.

VI. Coordination with VPI's Active DSP-5 Licenses

VPI currently holds three (3) active DSP-5 export licenses authorizing the permanent export of specified ITAR Category XI(a)(3) defense articles to end users in the United Kingdom and Australia. These licenses support VPI's deliveries under cooperative defense programs with two of the United States' closest allies. The continuation of these licenses is important to VPI's ongoing business operations and to the broader defense cooperation relationships with the UK and Australia.

The change in VPI's ownership will require amendment of these DSP-5 licenses to reflect the new ownership structure. Under ITAR § 123.9 and related provisions, export licenses are issued to specific applicants and are not automatically transferable in connection with a change of ownership. VPI must submit applications to DDTC to amend each active DSP-5 license to reflect the new ownership by Halcyon US Holdings Inc. and HSAG. The details of the DSP-5 license amendment process, including the specific information to be provided to DDTC and the anticipated timeline, are addressed in the companion DSP-5 License Continuation Memorandum.

From a coordination perspective, the DDTC registration notification under ITAR § 122.4(a) and the DSP-5 license amendment applications should be submitted to DDTC either simultaneously or in close temporal proximity. Presenting both filings together allows DDTC to review VPI's continued eligibility for registration and the continuing validity of its export licenses in a coordinated manner, rather than addressing these related issues in separate and potentially inconsistent proceedings. We recommend that the notification letter expressly reference the simultaneously filed DSP-5 license amendment applications, and vice versa, to ensure that DDTC's reviewers are aware of the full scope of the regulatory filings.

Interim Compliance. An important practical concern during the transition period — the period between the date of closing and the date of DDTC's acknowledgment of the ownership change notification — is whether VPI may continue to execute exports under its existing DSP-5 licenses. Our recommendation is that VPI should not execute any new exports under existing DSP-5 licenses during this interim period, unless and until DDTC provides advance guidance (either in response to the pre-notification engagement or in its acknowledgment of the formal notification) that existing licenses remain valid and operative during the transition period. This conservative approach is warranted by the legal uncertainty regarding the effect of an ownership change on the validity of existing licenses and is designed to minimize VPI's exposure to potential ITAR violations. VPI should plan its production and delivery schedules accordingly and should coordinate with its UK and Australian customers to manage expectations regarding any temporary pause in deliveries.

If advance guidance from DDTC is obtained during the pre-notification engagement confirming that existing DSP-5 licenses remain valid pending the completion of the amendment process, VPI may continue to execute exports in reliance on that guidance. We will seek such guidance as part of our pre-notification strategy.

VII. Coordination with Government Contracts and Facility Security Clearance

A. FAR 42.12 Novation Requirements

The change in VPI's ownership triggers novation and successor-in-interest considerations under Federal Acquisition Regulation ("FAR") Subpart 42.12 for a number of VPI's active government contracts. Our review of VPI's fourteen (14) active DoD contracts (prime and subcontract) has identified eight (8) contracts that require formal novation agreements under FAR 42.12 due to the change in ownership. The remaining six (6) contracts either contain change-of-ownership provisions that accommodate the transaction without formal novation or are structured as subcontracts under which the prime contractor's consent (rather than a government novation) is the applicable mechanism.

The government contracts novation process is addressed in detail in the companion Government Contracts Novation/Change-of-Name Analysis memorandum. For present purposes, it is sufficient to note that the DDTC registration notification and the government contracts novation proceedings are separate regulatory processes that must be coordinated but are not interdependent. The novation process is administered by the Administrative Contracting Officer ("ACO") at the Defense Contract Management Agency ("DCMA"), while the DDTC notification is addressed to DDTC's Office of Defense Trade Controls Management. Each proceeding operates under its own regulatory framework and timeline.

However, the two processes are substantively interconnected. Contracting officers responsible for VPI's government contracts will need assurance that VPI's DDTC registration remains valid and uninterrupted following the ownership change, because the DDTC registration is a prerequisite for VPI's manufacture and export of defense articles under those contracts. If DDTC were to revoke or suspend VPI's registration, VPI would be unable to perform on its ITAR-controlled contracts, which would in turn create defaults or termination-for-cause scenarios under those agreements. Accordingly, the novation documentation should include a representation by VPI that its DDTC registration has been maintained and that the required § 122.4(a) notification has been filed, and the DDTC notification should note that the government contracts novation process is proceeding in parallel.

B. Facility Security Clearance (FCL)

VPI's Facility Security Clearance at the SECRET level, associated with CAGE Code 7VK92, is a critical component of VPI's ability to perform on classified government contracts. The FCL is maintained through the NSA's SSA-equivalent framework, which allows VPI to retain its FCL notwithstanding the foreign ownership by HSAG. Under the SSA-equivalent framework, VPI's classified operations are insulated from foreign influence through the Government Security Committee, the Technology Control Plan, and the continuing oversight of DCSA.

The DDTC change-of-ownership notification should reference VPI's continuing FCL and the DCSA-approved FOCI mitigation measures under the NSA. The continuing FCL provides DDTC with important additional assurance that VPI's operations are being conducted in a secure environment that protects both classified information and ITAR-controlled defense articles and technical data. The overlap between the FCL requirements and the ITAR compliance requirements reinforces the comprehensive nature of the post-closing compliance framework.

Colonel (Ret.) Bryce Hendrickson continues as Facility Security Officer post-closing, providing critical continuity in the personnel with direct responsibility for both ITAR compliance and facility security. Col. Hendrickson has served as FSO since 2016 and has established effective working relationships with DCSA field representatives and DDTC staff. His continuation in these roles eliminates the disruption that would otherwise result from a change in the primary security and compliance officer during the ownership transition.

C. DFARS 252.209-7002 Disclosures

VPI is subject to the disclosure requirements of Defense Federal Acquisition Regulation Supplement ("DFARS") clause 252.209-7002 (Disclosure of Ownership or Control by a Foreign Government). While this clause is directed specifically at foreign government ownership or control, VPI is also subject to the broader DFARS foreign ownership disclosure requirements that apply to contractors with foreign-owned parent entities. VPI's obligation to disclose the HSAG ownership to its contracting officers under these DFARS requirements is a parallel regulatory obligation that must be satisfied separately from and in addition to the DDTC notification.

We recommend that the DFARS disclosures be aligned in content and timing with the DDTC notification and the DCSA post-closing notification. Consistent messaging across all regulatory filings is essential to avoid confusion or the appearance of inconsistency among government agencies. The companion DFARS Foreign Ownership Disclosure Requirements Memorandum addresses the specific DFARS provisions and the recommended disclosure content in detail.

VIII. Personnel Continuity Considerations

The continuity of VPI's key personnel is a central element of the overall compliance and regulatory continuity strategy. The NSA requires that three key VPI personnel — Dr. Nathan Trevorrow (CEO), Marissa Sung-Avila (President and COO), and Colonel (Ret.) Bryce Hendrickson (VP Government Programs and FSO) — remain employed by VPI for a minimum of twenty-four (24) months following the closing of the transaction. If any of these individuals departs VPI during the 24-month period, their replacement must be approved by the Government Security Committee and by DCSA. This requirement ensures that VPI's ITAR compliance leadership remains stable during the critical post-acquisition transition period and that any changes in key personnel are subject to U.S. government oversight.

Colonel Hendrickson's continuation as VP Government Programs and FSO is particularly critical for DDTC registration continuity. He serves as VPI's primary point of contact for ITAR compliance, including the preparation and submission of export license applications, the maintenance of the DDTC registration, the conduct of internal ITAR compliance training, and the management of VPI's interactions with DDTC staff. His familiarity with VPI's ITAR-controlled operations, his established relationships with government counterparts, and his active TS/SCI clearance make him an indispensable resource during the ownership transition. The DDTC notification should emphasize Col. Hendrickson's continuing role and his qualifications to ensure DDTC's confidence in the continuity of VPI's ITAR compliance oversight.

Dr. Trevorrow (TS/SCI clearance) and Ms. Sung-Avila (SECRET clearance) provide senior leadership continuity over VPI's ITAR-controlled programs. Dr. Trevorrow, as founder and CEO, has been intimately involved in VPI's defense business since its inception and has personal knowledge of VPI's product lines, customer relationships, and technical capabilities. Ms. Sung-Avila, as President and COO, oversees VPI's day-to-day operations, including manufacturing operations at the Albuquerque facility. Their continued involvement ensures that VPI's defense operations are managed by individuals with deep institutional knowledge and the requisite security clearances.

Looking beyond the initial 24-month period, any future change in VPI's designated ITAR empowered official or in other key ITAR compliance officers will require a separate notification to DDTC under § 122.4(a) as a further material change to VPI's registration information. VPI should establish internal protocols to ensure that any such changes are identified and reported to DDTC within the required timeframe. The compliance monitor, Whitmore Compliance Group LLC, should also be tasked with monitoring personnel changes that may trigger DDTC notification requirements as part of its ongoing compliance assessment activities.

IX. Recommended Timeline and Action Items

A. Pre-Closing Preparation

The following action items should be completed prior to the targeted closing date of February 9, 2024:

1. Draft ITAR § 122.4(a) Notification Letter. David Caruso and Priya Venkataraman will prepare a draft of the ITAR § 122.4(a) notification letter, including all supporting documentation identified in Section III.D above. Target completion of initial draft: December 15, 2023. Target completion of final draft (incorporating comments from all stakeholders): January 31, 2024.

2. Coordinate with VPI Outside Counsel. Coordinate with Wethersfield & Gale LLP (Harrison Whitfield, Sandra Niehaus, and Tobias Kwan), who represent VPI in connection with the transaction, to obtain all VPI-side information required for the notification, including current registration details, officer information, facility information, and any historical DDTC correspondence relevant to the notification.

3. Confirm VPI's Current Registration Status and Renewal Date. Contact DDTC to confirm VPI's current registration status, the date of the most recent renewal, and the next renewal

MEMORANDUM
PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION ATTORNEY WORK PRODUCT
TO: Beatrice Holloway, Responsible Partner, Mergers & Acquisitions Margaret "Peggy" Ashworth, Of Counsel, National Security & CFIUS
FROM: Lt. Col. (Ret.) David Caruso, Senior Counsel, Government Contracts & Export Controls Priya Venkataraman, Associate, International Trade & Sanctions
CC: Stefan Lohse, General Counsel, Halcyon Semiconductor AG Christy Bauer, Working Associate, intellectual Property
DATE: August 14, 2023
RE: DDTC Registration Transfer Analysis — Maintenance of Marlowe Asset Management Photonics Inc. ITAR Registration (Registration No. M-24817) Following Acquisition by Halcyon Semiconductor AG
MATTER: Halcyon Semiconductor AG / Marlowe Asset Management Photonics Inc. Acquisition — CFIUS Filing & Mitigation (C&H Matter No. 1032-00004)
CFIUS Case No.: CFIUS-023-07-3841
Right-click to update Table of Contents
I. Executive Summary
This memorandum analyzes the regulatory requirements for maintaining Marlowe Asset Management Photonics Inc.'s ("VPI") registration with the Directorate of Defense Trade Controls ("DDTC"), U.S. Department of State, following the proposed acquisition of 100% of VPI's outstanding equity by Halcyon US Holdings Inc. ("Halcyon US"), a Delaware C-corporation that is wholly owned by Halcyon Semiconductor Aktiengesellschaft ("HSAG"), a German public company listed on the Frankfurt Stock Exchange (XETRA: HLC). The analysis addresses the applicable International Traffic in Arms Regulations ("ITAR") requirements, the interaction between the DDTC notification obligations and the ongoing Committee on Foreign Investment in the United States ("CFIUS") review and anticipated National Security Agreement ("NSA"), and the recommended timeline for completing all necessary regulatory filings.
Key Conclusion. VPI's DDTC registration (Registration No. M-24817) must be maintained without interruption following the closing of the transaction. The change in ownership of VPI from its current shareholders to Halcyon US (and, through Halcyon US, to HSAG) triggers mandatory notification and amendment obligations under ITAR § 122.4(a) (22 C.F.R. § 122.4(a)). Failure to properly and timely notify DDTC of the ownership change could result in revocation of VPI's registration and the consequent loss of VPI's authority to manufacture and export defense articles classified under the United States Munitions List ("USML"). Such an outcome would be catastrophic to VPI's ongoing business operations and government contract performance, and would constitute a material adverse effect under the Stock Purchase Agreement. Accordingly, strict compliance with the ITAR notification requirements is both a regulatory imperative and a commercial necessity.
VPI has been registered with DDTC continuously since 2011. During this period, VPI has developed a significant defense business centered on the design and manufacture of advanced gallium-nitride ("GaN") power amplifier chips and high-electron-mobility transistor ("HEMT") components. These products are classified as defense articles under ITAR Category XI(a)(3) of the USML — electronic equipment and components specifically designed, modified, or configured for military applications, including defense radar and satellite communications systems. VPI's DDTC registration is the foundational authorization enabling VPI to engage in this business.
VPI currently holds three (3) active DSP-5 export licenses authorizing deliveries of defense articles to the United Kingdom and Australia, both NATO allies or close defense cooperation partners of the United States. The impact of the ownership change on these DSP-5 licenses is addressed separately in the companion memorandum titled DSP-5 License Continuation Memorandum (C&H Matter No. 1032-00004, Sub-File 4B), which should be read in conjunction with this analysis.
This memorandum also addresses the critical coordination between the DDTC notification process and the National Security Agreement currently being negotiated with CFIUS, with particular focus on the Technology Control Plan ("TCP") provisions that will be set forth in the NSA's Annex B. The TCP provisions are expected to establish the compliance framework that will govern VPI's handling of ITAR-controlled technical data and defense articles in the post-closing environment, and they will serve as the primary basis for DDTC's assessment of whether continued registration under foreign ownership is appropriate. Coordination of the DDTC notification with the NSA framework is therefore essential to presenting a unified and compliance picture to the U.S. government.
The closing of the acquisition is currently targeted for early 2024, following the completion of the CFIUS review and the execution of the NSA. The DDTC notification should be prepared in draft form well in advance of closing so that it can be filed promptly — within five (5) business days of the closing date — in compliance with the regulatory timeline.
II. Background
A. The Transaction
Halcyon Semiconductor AG ("HSAG"), a German Aktiengesellschaft (public stock corporation) headquartered at Industriestraße 44, 01099 Dresden, Saxony, Federal Republic of Germany, is acquiring 100% of the outstanding equity of Marlowe Asset Management Photonics Inc. ("VPI"), a Delaware C-corporation incorporated on February 14, 2009, and headquartered at 7400 Ridgeline Parkway, Colorado Springs, Colorado 80919. The acquisition is being effectuated through a wholly owned acquisition vehicle, Halcyon US Holdings Inc. ("Halcyon US"), a Delaware corporation formed on June 5, 2023, with a registered agent located at 160 Greentree Drive, Suite 101, Dover, Delaware 19904 (EIN: 93-2841067). Halcyon US was formed as a single-purpose entity for the purpose of holding HSAG's equity interest in VPI and serving as the direct parent of VPI in the post-closing corporate structure.
The Stock Purchase Agreement ("SPA") was executed on June 10, 2023. The base purchase price is $1.42 billion on an all-cash, cash-free, debt-free basis, with a normalized net working capital target of $34.6 million. An earnout provision provides for additional contingent consideration of up to $85 million based on achievement of specified revenue and contract backlog milestones during the 24-month period following closing, resulting in a maximum aggregate consideration of $1.505 billion.
The transaction is structured as a 100% equity acquisition. VPI will continue as a going concern following the closing and will operate as a wholly owned subsidiary of Halcyon US. VPI will retain its separate legal identity as a Delaware corporation, its own management team, its existing facilities, and its existing government contracts and security clearances. This structural continuity is a critical element both for the CFIUS mitigation framework and for the DDTC registration maintenance analysis set forth in this memorandum.
The SPA contains customary conditions to closing, including, among others: (i) receipt of CFIUS clearance (either express approval or expiration of the applicable review/investigation period without action), (ii) expiration or termination of the applicable waiting period under the Hart-Scott-Rodino Antitrust Improvements Act of 1976, (iii) receipt of applicable foreign regulatory approvals (including the German Federal Ministry for Economic Affairs and Climate Action under the Foreign Trade and Payments Act (Außenwirtschaftsgesetz)), and (iv) absence of any material adverse effect. The SPA does not separately condition closing on DDTC approval of the ownership change notification, though it does contain a covenant requiring the parties to use commercially reasonable efforts to maintain VPI's material governmental authorizations, including its DDTC registration.
B. VPI's DDTC Registration and ITAR-Controlled Activities
VPI has been registered with DDTC continuously since 2011 under Registration No. M-24817. The registration has been renewed without interruption during this period, and VPI is currently in good standing with DDTC. There are no pending enforcement actions, compliance inquiries, or voluntary disclosures involving VPI before DDTC as of the date of this memorandum.
VPI's core business consists of the design and manufacture of advanced GaN-on-silicon carbide ("GaN-on-SiC") power amplifier chips and high-electron-mobility transistor ("HEMT") components. These products represent a critical enabling technology for defense radar systems, satellite communications platforms, electronic warfare systems, and related military applications. VPI is one of a limited number of domestic suppliers with the capability to fabricate GaN-on-SiC components at the performance levels and reliability standards required by the U.S. Department of Defense ("DoD") and its allied counterparts.
VPI's principal defense products are classified as defense articles under ITAR Category XI(a)(3) of the United States Munitions List (22 C.F.R. § 121.1), which covers electronic equipment, including but not limited to electronic countermeasure and counter-countermeasure equipment, radar equipment, and electronic components specifically designed, modified, or configured for military applications. In addition to its ITAR-controlled products, VPI manufactures certain dual-use components that are classified under the Export Administration Regulations ("EAR") under Export Control Classification Numbers ("ECCNs") 3A001 (electronic components), 3A991 (electronic devices and components not controlled by 3A001), and 3E001 (technology for the development or production of commodities controlled by 3A001). The interplay between ITAR and EAR classifications is addressed separately in the companion ITAR/EAR Classification Review Memorandum prepared by Christy Bauer, which identifies six (6) items requiring reclassification review in connection with the post-closing compliance program.
VPI's manufacturing operations are conducted at its fabrication facility located at 9200 Innovation Boulevard, Albuquerque, New Mexico 87113. This facility comprises approximately 45,000 square feet of GaN-on-SiC fabrication capacity and maintains a Facility Security Clearance ("FCL") up to the SECRET level, assigned CAGE Code 7VK92. The facility is equipped with specialized manufacturing equipment for epitaxial growth, photolithography, etching, metallization, and wafer-level testing of GaN-on-SiC devices. The facility's FCL is essential for VPI's performance of classified government contracts and is maintained under the oversight of the Defense Counterintelligence and Security Agency ("DCSA"), as discussed further in Section VII.B below.
VPI's DUNS Number is 07-812-4493, and its Employer Identification Number (EIN) is 26-4371885. These identifiers are associated with VPI's registrations in the System for Award Management ("SAM"), DDTC's registration system, and the DCSA National Industrial Security Program ("NISP") records.
VPI currently holds three (3) active DSP-5 export licenses authorizing the permanent export of specified ITAR Category XI(a)(3) defense articles to end users in the United Kingdom and Australia. These licenses support deliveries under cooperative defense programs with these NATO and allied nations. The status and required amendments of these licenses are addressed in the companion DSP-5 License Continuation Memorandum.
VPI maintains fourteen (14) active contracts with the U.S. Department of Defense, consisting of both prime contracts and subcontracts. The aggregate backlog under these contracts is approximately $193 million as of the most recent quarterly reporting period. These contracts span multiple DoD agencies and programs, including contracts with the Defense Advanced Research Projects Agency ("DARPA"), the U.S. Air Force Research Laboratory ("AFRL"), the Missile Defense Agency ("MDA"), and several classified programs. The continuation of VPI's DDTC registration is a contractual requirement under a number of these agreements, and loss of registration would constitute a material breach or default event under the applicable contract terms.
Of VPI's 486 total employees, 212 hold active U.S. government security clearances at various levels. Colonel (Ret.) Bryce Hendrickson serves as VPI's Vice President, Government Programs, and Facility Security Officer ("FSO"). Col. Hendrickson holds an active TS/SCI clearance and has served in the FSO role since 2016. He is the primary point of contact for VPI's interactions with DCSA, DDTC, and contracting officers on matters relating to security clearances, ITAR compliance, and classified program management. His continuation in these roles post-closing is a key element of the overall compliance and regulatory continuity strategy.
C. HSAG Overview
HSAG is a German Aktiengesellschaft (public stock corporation) organized under the laws of the Federal Republic of Germany and commercially registered as HRB 28416 with the Amtsgericht (District Court) Dresden. HSAG's Legal Entity Identifier (LEI) is 5299007KXQ2M4GHILZ38. As of June 1, 2023, HSAG's market capitalization was approximately €14.8 billion. For fiscal year 2022, HSAG reported consolidated revenues of €6.12 billion and earnings before interest, taxes, depreciation, and amortization ("EBITDA") of €1.37 billion.
HSAG is a global semiconductor company with principal operations in Germany, the European Union, and Asia. HSAG's product portfolio includes power semiconductors, sensors, microcontrollers, and related electronic components for automotive, industrial, and consumer applications. While HSAG has extensive experience in semiconductor manufacturing, it does not currently manufacture or export ITAR-controlled defense articles and is not registered with DDTC. HSAG's acquisition of VPI represents its first significant entry into the U.S. defense semiconductor market.
HSAG maintains existing U.S. operations through Halcyon US Inc., a Delaware corporation located at 11501 Alterra Parkway, Suite 300, Austin, Texas 78758 (EIN: 81-3056429). Halcyon US Inc. is a fabless design center employing approximately 320 persons, focused on analog and mixed-signal integrated circuit design for commercial automotive and industrial applications. Halcyon US Inc. does not perform any classified work, does not hold a DDTC registration, and does not engage in any ITAR-controlled activities. It is important to note that Halcyon US Inc. (the existing Austin entity) is distinct from Halcyon US Holdings Inc. (the newly formed Delaware acquisition vehicle). Post-closing, VPI will be a subsidiary of Halcyon US Holdings Inc., not of Halcyon US Inc.
HSAG's Chief Executive Officer is Dr. Maximilian Ehrhardt, a German citizen who does not hold a U.S. security clearance. HSAG's General Counsel is Stefan Lohse, LL.M. (Georgetown University), who is admitted to practice law in both the State of New York and the Federal Republic of Germany and holds dual German and U.S. citizenship. Mr. Lohse is copied on this memorandum in his capacity as HSAG's General Counsel and the primary HSAG-side counterpart for the regulatory compliance workstreams addressed herein.
HSAG is not currently a registrant with DDTC and does not manufacture or export ITAR-controlled defense articles. This fact is significant for the DDTC notification analysis because DDTC will assess the foreign parent's profile and history in evaluating the continued registration application. While HSAG has no ITAR track record, its position as a major European semiconductor manufacturer headquartered in a NATO ally country, and the comprehensive mitigation framework established through the CFIUS NSA, are expected to provide a sufficient basis for DDTC's approval of continued registration.
D. Existing VPI Shareholders (Pre-Closing)
VPI's outstanding equity is currently held by the following shareholders, all of whom will be selling their entire equity interests in connection with the transaction:
It is noteworthy that the two institutional investors — Ridgecrest Ventures Fund III, L.P. and Cascadian Capital Partners Growth Fund II, L.P. — are U.S.-based venture capital and growth equity funds. Neither fund is affiliated with any foreign person, and neither fund's involvement has previously triggered any FOCI considerations. The transition from domestic private ownership to foreign ownership through HSAG is what necessitates the heightened regulatory analysis set forth in this memorandum.
Dr. Trevorrow and Ms. Sung-Avila are expected to remain in their current executive roles for a minimum of 24 months post-closing under the terms of the NSA, as discussed further in Section VIII below. Their continued leadership provides important continuity for both ITAR compliance and the broader defense business.
III. ITAR Registration Requirements — Legal Framework
A. Overview of ITAR Registration Under 22 C.F.R. Part 122
The International Traffic in Arms Regulations, codified at 22 C.F.R. Parts 120–130, implement the Arms Export Control Act ("AECA"), 22 U.S.C. §§ 2751 et seq., and govern the export and temporary import of defense articles and defense services, as well as the brokering of defense articles. Part 122 of the ITAR establishes the registration requirements that apply to any person who engages in the United States in the business of manufacturing, exporting, or temporarily importing defense articles, or furnishing defense services.
Specifically, ITAR § 122.1(a) provides that any person who engages in the United States in the business of either manufacturing or exporting defense articles or furnishing defense services is required to register with DDTC. Registration is not merely an administrative formality; it is a jurisdictional prerequisite for any export or manufacturing authorization. A person who is not registered with DDTC may not apply for or receive export licenses (including DSP-5, DSP-73, or DSP-85 licenses), may not utilize license exemptions under ITAR Part 126, and may not manufacture defense articles for sale or export. In practical terms, loss of registration would preclude VPI from performing on its existing government contracts that involve the manufacture, sale, or delivery of ITAR-controlled defense articles. Given that VPI's defense contracts represent a substantial majority of VPI's revenue and constitute the core of its business value, the maintenance of DDTC registration is, by any measure, essential to VPI's viability as a going concern and to the value of the acquisition to HSAG.
The registration period under DDTC's current practice is typically annual, although DDTC has at various times permitted multi-year registrations. Registrants are required to submit renewal applications in advance of the expiration of their registration period, together with the applicable registration fee. VPI's registration has been continuously maintained since its initial registration in 2011, reflecting an unbroken twelve-year compliance history. This track record of responsible DDTC registration and compliance is a positive factor that should be emphasized in the change-of-ownership notification.
DDTC's registration system also requires registrants to maintain accurate and current information on file, including information regarding the registrant's legal name, address, organizational structure, officers, and the nature of its defense article manufacturing and export activities. The obligation to update this information in connection with material changes — including, critically, changes in ownership — is the subject of ITAR § 122.4(a), which is the operative regulatory provision for the analysis in this memorandum.
B. ITAR § 122.4(a) — Notification of Changes in Registration Information
Section 122.4(a) of the ITAR (22 C.F.R. § 122.4(a)) imposes an affirmative obligation on DDTC registrants to notify DDTC of any material change in the information previously provided at the time of registration or in connection with the most recent registration renewal. The regulation provides, in relevant part, that a registrant must notify DDTC of any change that is material to the registration, and specifically identifies changes in ownership or control as material changes requiring notification.
The acquisition of 100% of VPI's outstanding equity by Halcyon US Holdings Inc. — and the resulting indirect ownership of VPI by HSAG, a foreign person organized under the laws of Germany — is a paradigmatic change-of-ownership event that triggers the notification requirement under ITAR § 122.4(a). The change is material not only because VPI's shareholder composition will change entirely, but because the new ultimate parent entity is a foreign person, which introduces foreign ownership, control, or influence ("FOCI") considerations that did not exist under VPI's prior ownership structure.
The notification must be submitted in writing to DDTC's Office of Defense Trade Controls Management ("DTCM"). While DDTC has at times accepted electronic filings for certain routine updates, it is our practice — and our recommendation — that a change-of-ownership notification of this significance be submitted formally in writing, with supporting documentation, to the DTCM Director. A cover letter from VPI's designated ITAR compliance officer (Col. (Ret.) Bryce Hendrickson) should accompany the notification, together with the supporting materials described in Section III.D below.
It is important to emphasize, for the benefit of all parties and their respective counsel, that the ITAR § 122.4(a) notification obligation is distinct from and independent of the CFIUS filing and clearance process. Compliance with CFIUS — including the execution and implementation of a National Security Agreement — does not substitute for, satisfy, or in any way discharge the separate ITAR notification obligation. While the CFIUS and ITAR processes are related, and while the mitigation measures adopted through the CFIUS process will be highly relevant to DDTC's evaluation of the ownership change, each regulatory regime imposes its own independent requirements. Failure to satisfy the ITAR notification requirement, even in circumstances where CFIUS clearance has been obtained, could result in an independent violation of the ITAR.
C. Timing of Notification
ITAR § 122.4(a) requires that the notification of a material change be submitted within a specified period following the effective date of the change. DDTC's current guidance and practice establish a notification window of five (5) business days from the date the change becomes effective — that is, five business days from the date of closing. Given that the transaction closing is currently targeted for February 9, 2024 (a Friday), the notification deadline would be approximately February 16, 2024 (the following Friday, assuming no intervening federal holidays).
As a matter of best practice, and in light of the significance and complexity of this particular ownership change, we strongly recommend that the notification be prepared in final draft form well in advance of closing. Ideally, the notification letter and all supporting documentation should be substantially complete no later than January 31, 2024, such that they can be reviewed and approved by the relevant stakeholders and filed immediately upon closing. Prompt filing — on the day of closing or the first business day thereafter — demonstrates good faith compliance and minimizes the risk of any gap in VPI's registration status.
In addition to the post-closing notification, we recommend that VPI and Halcyon US engage in pre-notification or advance engagement with DDTC prior to closing. This is standard practice for significant ownership changes, particularly those involving foreign acquirors. Advance engagement allows the parties to alert DDTC to the forthcoming change, to preview the anticipated notification content, and to address any preliminary questions or concerns that DDTC may have. This approach reduces the likelihood of unexpected issues arising after the notification is filed and facilitates a smoother review process. The advance engagement can be conducted informally, through a meeting or telephone call between VPI's ITAR compliance officer and the DTCM Director, or more formally through a pre-notification letter.
Given that CFIUS clearance is a condition to closing under the SPA, the DDTC notification timing should be carefully coordinated with the CFIUS clearance timeline. The CFIUS review is currently in the investigation phase (the 45-day investigation period commenced on July 24, 2023), and the parties anticipate that the NSA negotiations may extend into Q4 2023 or Q1 2024. The DDTC notification cannot be filed until closing occurs, but the advance preparation and pre-notification engagement can and should proceed in parallel with the CFIUS process.
D. Content of the ITAR § 122.4(a) Notification
The ITAR § 122.4(a) notification should include the following information, at a minimum, to provide DDTC with a comprehensive picture of the ownership change and the measures being taken to ensure continued ITAR compliance:
(a) Registrant Information. Full legal name and address of VPI (Marlowe Asset Management Photonics Inc., 7400 Ridgeline Parkway, Colorado Springs, CO 80919), together with VPI's DDTC Registration Number (M-24817), DUNS Number (07-812-4493), EIN (26-4371885), and CAGE Code (7VK92).
(b) New Owner Information. Full legal name and address of the direct new owner (Halcyon US Holdings Inc., 160 Greentree Drive, Suite 101, Dover, DE 19904; EIN: 93-2841067) and the ultimate foreign parent entity (Halcyon Semiconductor AG, Industriestraße 44, 01099 Dresden, Saxony, Germany; commercial registration: HRB 28416, Amtsgericht Dresden; LEI: 5299007KXQ2M4GHILZ38).
(c) Description of the Change. A clear description of the change in ownership, including the fact that 100% of VPI's outstanding equity has been acquired by Halcyon US Holdings Inc., a newly formed Delaware corporation that is a wholly owned subsidiary of HSAG.
(d) Identification of the Foreign Parent Entity. Express identification of HSAG as a foreign person (a German Aktiengesellschaft), including its country of organization, principal place of business, and the nature of its business operations.
(e) Continuing Entity Status. Confirmation that VPI will continue to operate as a separate legal entity incorporated under the laws of the State of Delaware, with its own management, employees, facilities, and ITAR-controlled operations.
(f) Continuing Officers. Identification of VPI's continuing officers responsible for ITAR compliance, including: Dr. Nathan Trevorrow (CEO), who holds a TS/SCI clearance; Marissa Sung-Avila (President and COO), who holds a SECRET clearance; and Colonel (Ret.) Bryce Hendrickson (VP Government Programs and FSO), who holds a TS/SCI clearance and serves as VPI's primary ITAR compliance officer and DDTC point of contact.
(g) Continuing ITAR Activities. A statement describing VPI's continuing ITAR-controlled activities and product classifications, including the manufacture and export of defense articles classified under ITAR Category XI(a)(3) of the USML.
(h) CFIUS NSA Reference. Reference to the executed CFIUS National Security Agreement (anticipated to be designated NSA-2024-0019), including a summary of the key mitigation measures relevant to ITAR compliance — specifically, the Technology Control Plan (TCP) provisions, the Government Security Committee (GSC) structure, the continuing FCL, and the appointment of the third-party compliance monitor.
(i) FOCI Mitigation. Updated information regarding the foreign ownership, control, or influence (FOCI) arrangements applicable to VPI, including the NSA's function as a Special Security Agreement (SSA) equivalent for purposes of VPI's FCL, and the DCSA oversight mechanisms.
(j) Organizational Chart. An updated organizational chart reflecting the post-closing corporate structure: HSAG → Halcyon US Holdings Inc. → VPI.
The notification should be accompanied by relevant supporting documentation, including copies of (or references to) the executed NSA, the TCP, and the post-closing organizational chart. We recommend that the notification letter be signed by Col. (Ret.) Bryce Hendrickson in his capacity as VPI's VP Government Programs and FSO, with a countersignature or acknowledgment from Dr. Nathan Trevorrow as CEO.
IV. Foreign Ownership Considerations Under ITAR
A. ITAR § 120.15 — Definition of "Foreign Person"
The ITAR defines "foreign person" at 22 C.F.R. § 120.15 to include, among others, any corporation or other entity organized under the laws of a foreign country. HSAG, as a corporation organized under the laws of the Federal Republic of Germany, is unambiguously a "foreign person" within the meaning of the ITAR. This classification applies to HSAG regardless of its status as a publicly traded company, its commercial relationship with U.S. entities, or its status as a corporation of a NATO ally.
Following the closing of the transaction, VPI will be owned by a foreign person through the following corporate chain: HSAG (German Aktiengesellschaft) → Halcyon US Holdings Inc. (Delaware corporation) → VPI (Delaware corporation). While VPI itself will remain a U.S. entity organized under the laws of Delaware, its ultimate beneficial ownership will rest with a foreign person. This ownership structure has significant implications for VPI's DDTC registration, its handling of ITAR-controlled defense articles and technical data, and its eligibility to participate in classified government programs.
It is important to note, however, that the interposition of Halcyon US Holdings Inc. — a U.S.-organized entity — between HSAG and VPI does not alter the fundamental foreign ownership analysis. DDTC and other U.S. government agencies routinely look through intermediate holding entities to identify the ultimate beneficial owner. HSAG's indirect ownership of VPI through a Delaware holding company does not alter HSAG's status as a foreign person or diminish the foreign ownership implications of the transaction.
The classification of HSAG as a foreign person does not automatically disqualify VPI from maintaining its DDTC registration, but it does trigger heightened scrutiny and additional compliance obligations, as discussed in the following subsections. The practical impact of the foreign ownership classification is that DDTC will evaluate the ownership change through the lens of whether adequate safeguards are in place to prevent the unauthorized diversion of defense articles, defense services, or ITAR-controlled technical data to foreign persons, including to HSAG and its non-U.S. personnel.
B. Impact of Foreign Ownership on DDTC Registration
DDTC does not categorically prohibit ITAR registration by U.S. subsidiaries of foreign persons. There are numerous U.S. companies that maintain active DDTC registrations while being wholly owned by foreign parent entities, including parent entities organized in NATO ally countries and other close defense cooperation partners. The defense industrial base of the United States includes a significant number of foreign-owned, domestically controlled ("FODC") companies that play important roles in defense production and supply chains. DDTC's registration framework accommodates these companies, subject to appropriate safeguards.
However, DDTC will scrutinize the ownership change to assess whether the foreign ownership structure creates an unacceptable risk of diversion of defense articles or technical data to unauthorized foreign persons. This assessment will consider a number of factors, including but not limited to:
(i) the country of organization and principal place of business of the foreign parent entity, and the relationship between that country and the United States in defense and security matters;
(ii) the nature and sensitivity of the defense articles manufactured or exported by the registrant;
(iii) the adequacy of the safeguards in place to prevent unauthorized access by foreign persons to ITAR-controlled items and technical data;
(iv) the registrant's compliance history and the qualifications and experience of its ITAR compliance personnel;
(v) the existence of any U.S. government-approved mitigation framework, such as a CFIUS National Security Agreement or a DCSA-approved FOCI mitigation arrangement;
(vi) the registrant's facility security clearance status and the measures in place to protect classified information; and
(vii) any other factors that DDTC deems relevant to the assessment of risk.
In VPI's case, several of these factors weigh strongly in favor of continued registration. Germany is a NATO ally and one of the United States' closest defense cooperation partners, with extensive government-to-government defense trade relationships and a robust export control regime of its own. HSAG is a well-established, publicly traded company with no history of export control violations or sanctions issues. VPI's management team — including its CEO, COO, and FSO — will remain in place post-closing, providing continuity in ITAR compliance oversight. And the NSA negotiated through the CFIUS process will establish a comprehensive, U.S. government-approved mitigation framework specifically designed to address the risks associated with foreign ownership.
Notwithstanding these favorable factors, DDTC retains discretion to condition continued registration on the implementation of additional safeguards or to impose specific restrictions on VPI's activities. The potential conditions and restrictions are discussed in the following subsection.
C. Potential DDTC Conditions or Restrictions
Based on our experience with prior DDTC change-of-ownership reviews involving foreign acquirors, DDTC may impose one or more of the following conditions on VPI's continued registration:
(i) U.S. Citizen Empowered Officer. DDTC may require VPI to designate a U.S. citizen as the empowered officer responsible for overseeing all ITAR compliance activities, with authority to sign export license applications, approve transfers of technical data, and ensure compliance with all ITAR requirements. This role is currently performed by Col. (Ret.) Bryce Hendrickson, who is a U.S. citizen. The NSA's requirement that key ITAR compliance personnel be U.S. citizens aligns with this expected DDTC condition.
(ii) Enhanced Internal Compliance Program. DDTC may require VPI to implement an enhanced internal compliance program that goes beyond the standard ITAR compliance requirements, including more frequent training, additional record-keeping, and enhanced monitoring of technical data access. The TCP provisions of the NSA are expected to address these requirements in substantial detail.
(iii) Restrictions on Foreign Person Access. DDTC may impose explicit restrictions prohibiting non-U.S. persons — including HSAG personnel — from accessing ITAR-controlled technical data or defense articles without prior U.S. government authorization (i.e., an approved export license or applicable exemption). This restriction is fully consistent with the TCP's prohibition on the transfer of ITAR-controlled technical data to non-U.S. persons.
(iv) Periodic Reporting. DDTC may require VPI to submit periodic reports (e.g., annually or semi-annually) to DDTC summarizing VPI's ITAR compliance activities, any changes in personnel or organizational structure, and any incidents or potential violations. These reporting obligations can be coordinated with the annual compliance audits required under the NSA.
We anticipate that any conditions imposed by DDTC will be substantially aligned with the provisions of the NSA's Technology Control Plan, given that the TCP is being negotiated with the active participation of the Department of Defense and is designed to address precisely the same foreign ownership risks that DDTC will evaluate. To the extent that DDTC and the CFIUS monitoring agencies (principally DCSA) coordinate their oversight activities — which is the norm in cases involving DDTC registrants subject to NSAs — the conditions imposed by each agency should be harmonized to minimize duplicative or conflicting obligations on VPI. We will work to ensure this coordination through our advance engagement with DDTC and through dialogue with DCSA during the NSA negotiation process.
V. Coordination with the National Security Agreement and Technology Control Plan
A. NSA Framework (NSA-2024-0019)
The National Security Agreement, which is currently being negotiated between the transaction parties (HSAG, Halcyon US Holdings Inc., and VPI) and the U.S. Government (represented by the Departments of the Treasury, Defense, and Energy), is expected to be executed on or about January 19, 2024, and is anticipated to be designated as NSA-2024-0019. The NSA establishes comprehensive mitigation measures designed to address the national security risks identified by CFIUS in connection with the acquisition. These measures are tailored to the specific circumstances of VPI's business, including its DDTC registration, its ITAR-controlled activities, its classified government contracts, and its Facility Security Clearance.
The NSA functions as a Special Security Agreement ("SSA") equivalent for purposes of VPI's Facility Security Clearance under the National Industrial Security Program Operating Manual ("NISPOM"). The SSA-equivalent framework allows VPI to maintain its FCL at the SECRET level notwithstanding the foreign ownership by HSAG, subject to the implementation of specified FOCI mitigation measures. This is a critical element of the overall regulatory architecture, because VPI's FCL is required for the performance of its classified government contracts, which in turn depend on VPI's DDTC registration for the export and manufacture of ITAR-controlled defense articles.
The monitoring agency under the NSA is the Defense Counterintelligence and Security Agency ("DCSA"), which is also the cognizant security agency responsible for VPI's FCL under the NISPOM. DCSA's dual role as both the NSA monitoring agency and the FCL cognizant security agency provides a unified oversight framework that should give DDTC additional confidence in the effectiveness of the post-closing compliance structure.
In addition to DCSA oversight, the NSA requires the appointment of a third-party compliance monitor. The parties have selected Whitmore Compliance Group LLC to serve in this role. The principal of Whitmore Compliance Group is Gerald Whitmore, a former supervisory special agent with the FBI's Counterintelligence Division with over 25 years of experience in counterintelligence investigations and FOCI mitigation. Whitmore Compliance Group's offices are located at 1300 Crystal Drive, Suite 710, Arlington, Virginia 22202. The annual monitoring fee is $1.2 million per annum, payable in quarterly installments of $300,000, with all costs borne by HSAG. The compliance monitor will conduct periodic assessments of VPI's compliance with the NSA and TCP provisions, including compliance with ITAR requirements, and will submit reports to DCSA and the CFIUS monitoring agencies.
B. Technology Control Plan (TCP) — NSA Annex B
The Technology Control Plan, which will be set forth in Annex B to the NSA, is the core compliance framework governing VPI's handling of controlled technical data and defense articles in the post-closing environment. The TCP is designed to ensure that no ITAR-controlled or EAR-controlled technical data or defense articles are transferred to any non-U.S. person — including HSAG and its personnel — without prior authorization from the U.S. government. The TCP's provisions are directly relevant to DDTC's evaluation of VPI's continued registration and are expected to satisfy DDTC's requirements for adequate safeguards under foreign ownership.
The key TCP provisions relevant to the ITAR registration analysis include the following:
(a) Prohibition on Unauthorized Transfer. The TCP categorically prohibits the transfer of VPI technical data that is controlled under the ITAR or EAR to any non-U.S. person without prior authorization from the applicable U.S. government agency (DDTC for ITAR-controlled data, the Bureau of Industry and Security for EAR-controlled data). This prohibition applies to all forms of transfer, including oral, written, electronic, and visual disclosures.
(b) Exclusion of HSAG Personnel. HSAG personnel who are non-U.S. persons may not access ITAR Category XI(a)(3) defense articles or related technical data absent specific, case-by-case authorization from the U.S. government. This restriction applies regardless of the HSAG personnel's corporate role, seniority, or security clearance status (if any) in their home country. The restriction is enforced through physical and logical access controls, including badge access restrictions, network segmentation, and clean-desk policies.
(c) Information-Sharing Procedures. The TCP establishes carefully delineated procedures for sharing certain categories of business information between VPI and HSAG for legitimate business purposes (e.g., financial reporting, human resources administration, and non-technical commercial operations), while ensuring that controlled technical data is not included in or accessible through such information-sharing channels. These procedures include the use of designated review officers at VPI who screen all outbound communications to HSAG for controlled content.
(d) IT System Separation. VPI's information technology systems must be physically and logically separated from HSAG's global corporate network. No shared cloud infrastructure, shared servers, shared email systems, or shared collaboration platforms may be used for VPI's ITAR-controlled operations. VPI must maintain its own independent IT infrastructure, with access controls that prevent any non-U.S. person from accessing systems containing controlled technical data. This requirement extends to any third-party IT service providers, who must be U.S. persons and must hold appropriate security clearances if accessing classified data.
(e) Personnel Training and Certification. All VPI personnel with access to ITAR-controlled technical data or defense articles must receive initial and annual refresher training on the TCP requirements, including the restrictions on disclosure to non-U.S. persons. Personnel must certify their understanding and compliance with these requirements.
These TCP provisions provide a robust and detailed framework that directly addresses the concerns that DDTC would be expected to raise in evaluating VPI's continued registration under foreign ownership. By implementing the TCP, VPI will maintain the functional separation between its ITAR-controlled activities and HSAG's foreign operations that is necessary to prevent unauthorized access or diversion.
C. Cross-Reference Strategy
We recommend that the DDTC change-of-ownership notification filed under ITAR § 122.4(a) expressly reference the NSA (NSA-2024-0019) and the TCP (NSA Annex B) as the comprehensive framework for ensuring that ITAR compliance is maintained in the post-closing environment. This cross-referencing strategy serves several important purposes.
First, it demonstrates to DDTC that the foreign ownership risks associated with the HSAG acquisition have been thoroughly reviewed and addressed by the U.S. government through the CFIUS process, involving the Departments of the Treasury, Defense, and Energy. The fact that multiple U.S. government agencies have participated in the development and approval of the mitigation measures should carry significant weight with DDTC.
Second, the cross-reference allows VPI to present a unified and compliance picture, rather than requiring DDTC to evaluate VPI's continued registration in isolation from the broader regulatory framework. DDTC is aware that companies subject to CFIUS NSAs operate under comprehensive compliance frameworks, and the reference to the NSA provides DDTC with the full context necessary to assess the adequacy of the safeguards in place.
Third, DCSA's role as the monitoring agency under the NSA provides DDTC with ongoing assurance of compliance. DCSA already has oversight responsibility for VPI's Facility Security Clearance and is familiar with VPI's operations. The expansion of DCSA's monitoring role to encompass the NSA provisions, including the ITAR-related TCP requirements, creates a built-in compliance verification mechanism that should give DDTC confidence that the safeguards will be effectively implemented and maintained over time.
Fourth, the annual compliance audits conducted by Whitmore Compliance Group LLC will encompass ITAR compliance as part of the overall NSA compliance reporting. The results of these audits can be made available to DDTC upon request, providing an independent, third-party verification of VPI's ITAR compliance status. We recommend that the notification letter expressly offer to provide DDTC with copies of the annual compliance audit reports, subject to any applicable confidentiality restrictions.
D. Board Governance and Government Security Committee
The post-closing board governance structure established under the NSA provides an additional layer of oversight over VPI's ITAR-controlled activities that should be highlighted in the DDTC notification.
VPI's post-closing board of directors will consist of five (5) members, structured as follows:
(a) Three (3) Security Board Members — U.S. citizens who hold or are eligible to hold security clearances at the TS/SCI level, including at least one independent Security Director who is not affiliated with either VPI or HSAG. The Security Board Members are responsible for overseeing all aspects of VPI's classified and ITAR-controlled operations.
(b) Two (2) HSAG Designees — Representatives designated by HSAG who may participate in VPI board meetings and have access to non-controlled business information, but who may not hold or access classified information or ITAR-controlled technical data.
The three Security Board Members will constitute the Government Security Committee ("GSC"), which will have exclusive authority over the following matters:
(i) All classified and ITAR-controlled programs, contracts, and activities;
(ii) All personnel security matters, including the granting, denying, and revoking of security clearances;
(iii) All facility security matters, including the maintenance and administration of VPI's FCL;
(iv) All ITAR compliance matters, including the appointment and removal of ITAR compliance officers, the approval of export license applications, and the oversight of the Technology Control Plan; and
(v) All interactions with DDTC, DCSA, and other U.S. government agencies regarding classified, export-controlled, or national security matters.
The GSC's exclusive authority over ITAR-controlled activities ensures that foreign ownership does not translate into foreign control or influence over VPI's defense-related operations. This governance structure is a well-established element of FOCI mitigation and is recognized by both DCSA and DDTC as an effective mechanism for protecting national security interests while permitting foreign investment in the U.S. defense industrial base. The DDTC notification should describe the GSC structure and its authority in detail, as this governance mechanism directly addresses DDTC's core concern regarding foreign person access to and influence over ITAR-controlled activities.
VI. Coordination with VPI's Active DSP-5 Licenses
VPI currently holds three (3) active DSP-5 export licenses authorizing the permanent export of specified ITAR Category XI(a)(3) defense articles to end users in the United Kingdom and Australia. These licenses support VPI's deliveries under cooperative defense programs with two of the United States' closest allies. The continuation of these licenses is important to VPI's ongoing business operations and to the broader defense cooperation relationships with the UK and Australia.
The change in VPI's ownership will require amendment of these DSP-5 licenses to reflect the new ownership structure. Under ITAR § 123.9 and related provisions, export licenses are issued to specific applicants and are not automatically transferable in connection with a change of ownership. VPI must submit applications to DDTC to amend each active DSP-5 license to reflect the new ownership by Halcyon US Holdings Inc. and HSAG. The details of the DSP-5 license amendment process, including the specific information to be provided to DDTC and the anticipated timeline, are addressed in the companion DSP-5 License Continuation Memorandum.
From a coordination perspective, the DDTC registration notification under ITAR § 122.4(a) and the DSP-5 license amendment applications should be submitted to DDTC either simultaneously or in close temporal proximity. Presenting both filings together allows DDTC to review VPI's continued eligibility for registration and the continuing validity of its export licenses in a coordinated manner, rather than addressing these related issues in separate and potentially inconsistent proceedings. We recommend that the notification letter expressly reference the simultaneously filed DSP-5 license amendment applications, and vice versa, to ensure that DDTC's reviewers are aware of the full scope of the regulatory filings.
Interim Compliance. An important practical concern during the transition period — the period between the date of closing and the date of DDTC's acknowledgment of the ownership change notification — is whether VPI may continue to execute exports under its existing DSP-5 licenses. Our recommendation is that VPI should not execute any new exports under existing DSP-5 licenses during this interim period, unless and until DDTC provides advance guidance (either in response to the pre-notification engagement or in its acknowledgment of the formal notification) that existing licenses remain valid and operative during the transition period. This conservative approach is warranted by the legal uncertainty regarding the effect of an ownership change on the validity of existing licenses and is designed to minimize VPI's exposure to potential ITAR violations. VPI should plan its production and delivery schedules accordingly and should coordinate with its UK and Australian customers to manage expectations regarding any temporary pause in deliveries.
If advance guidance from DDTC is obtained during the pre-notification engagement confirming that existing DSP-5 licenses remain valid pending the completion of the amendment process, VPI may continue to execute exports in reliance on that guidance. We will seek such guidance as part of our pre-notification strategy.
VII. Coordination with Government Contracts and Facility Security Clearance
A. FAR 42.12 Novation Requirements
The change in VPI's ownership triggers novation and successor-in-interest considerations under Federal Acquisition Regulation ("FAR") Subpart 42.12 for a number of VPI's active government contracts. Our review of VPI's fourteen (14) active DoD contracts (prime and subcontract) has identified eight (8) contracts that require formal novation agreements under FAR 42.12 due to the change in ownership. The remaining six (6) contracts either contain change-of-ownership provisions that accommodate the transaction without formal novation or are structured as subcontracts under which the prime contractor's consent (rather than a government novation) is the applicable mechanism.
The government contracts novation process is addressed in detail in the companion Government Contracts Novation/Change-of-Name Analysis memorandum. For present purposes, it is sufficient to note that the DDTC registration notification and the government contracts novation proceedings are separate regulatory processes that must be coordinated but are not interdependent. The novation process is administered by the Administrative Contracting Officer ("ACO") at the Defense Contract Management Agency ("DCMA"), while the DDTC notification is addressed to DDTC's Office of Defense Trade Controls Management. Each proceeding operates under its own regulatory framework and timeline.
However, the two processes are substantively interconnected. Contracting officers responsible for VPI's government contracts will need assurance that VPI's DDTC registration remains valid and uninterrupted following the ownership change, because the DDTC registration is a prerequisite for VPI's manufacture and export of defense articles under those contracts. If DDTC were to revoke or suspend VPI's registration, VPI would be unable to perform on its ITAR-controlled contracts, which would in turn create defaults or termination-for-cause scenarios under those agreements. Accordingly, the novation documentation should include a representation by VPI that its DDTC registration has been maintained and that the required § 122.4(a) notification has been filed, and the DDTC notification should note that the government contracts novation process is proceeding in parallel.
B. Facility Security Clearance (FCL)
VPI's Facility Security Clearance at the SECRET level, associated with CAGE Code 7VK92, is a critical component of VPI's ability to perform on classified government contracts. The FCL is maintained through the NSA's SSA-equivalent framework, which allows VPI to retain its FCL notwithstanding the foreign ownership by HSAG. Under the SSA-equivalent framework, VPI's classified operations are insulated from foreign influence through the Government Security Committee, the Technology Control Plan, and the continuing oversight of DCSA.
The DDTC change-of-ownership notification should reference VPI's continuing FCL and the DCSA-approved FOCI mitigation measures under the NSA. The continuing FCL provides DDTC with important additional assurance that VPI's operations are being conducted in a secure environment that protects both classified information and ITAR-controlled defense articles and technical data. The overlap between the FCL requirements and the ITAR compliance requirements reinforces the comprehensive nature of the post-closing compliance framework.
Colonel (Ret.) Bryce Hendrickson continues as Facility Security Officer post-closing, providing critical continuity in the personnel with direct responsibility for both ITAR compliance and facility security. Col. Hendrickson has served as FSO since 2016 and has established effective working relationships with DCSA field representatives and DDTC staff. His continuation in these roles eliminates the disruption that would otherwise result from a change in the primary security and compliance officer during the ownership transition.
C. DFARS 252.209-7002 Disclosures
VPI is subject to the disclosure requirements of Defense Federal Acquisition Regulation Supplement ("DFARS") clause 252.209-7002 (Disclosure of Ownership or Control by a Foreign Government). While this clause is directed specifically at foreign government ownership or control, VPI is also subject to the broader DFARS foreign ownership disclosure requirements that apply to contractors with foreign-owned parent entities. VPI's obligation to disclose the HSAG ownership to its contracting officers under these DFARS requirements is a parallel regulatory obligation that must be satisfied separately from and in addition to the DDTC notification.
We recommend that the DFARS disclosures be aligned in content and timing with the DDTC notification and the DCSA post-closing notification. Consistent messaging across all regulatory filings is essential to avoid confusion or the appearance of inconsistency among government agencies. The companion DFARS Foreign Ownership Disclosure Requirements Memorandum addresses the specific DFARS provisions and the recommended disclosure content in detail.
VIII. Personnel Continuity Considerations
The continuity of VPI's key personnel is a central element of the overall compliance and regulatory continuity strategy. The NSA requires that three key VPI personnel — Dr. Nathan Trevorrow (CEO), Marissa Sung-Avila (President and COO), and Colonel (Ret.) Bryce Hendrickson (VP Government Programs and FSO) — remain employed by VPI for a minimum of twenty-four (24) months following the closing of the transaction. If any of these individuals departs VPI during the 24-month period, their replacement must be approved by the Government Security Committee and by DCSA. This requirement ensures that VPI's ITAR compliance leadership remains stable during the critical post-acquisition transition period and that any changes in key personnel are subject to U.S. government oversight.
Colonel Hendrickson's continuation as VP Government Programs and FSO is particularly critical for DDTC registration continuity. He serves as VPI's primary point of contact for ITAR compliance, including the preparation and submission of export license applications, the maintenance of the DDTC registration, the conduct of internal ITAR compliance training, and the management of VPI's interactions with DDTC staff. His familiarity with VPI's ITAR-controlled operations, his established relationships with government counterparts, and his active TS/SCI clearance make him an indispensable resource during the ownership transition. The DDTC notification should emphasize Col. Hendrickson's continuing role and his qualifications to ensure DDTC's confidence in the continuity of VPI's ITAR compliance oversight.
Dr. Trevorrow (TS/SCI clearance) and Ms. Sung-Avila (SECRET clearance) provide senior leadership continuity over VPI's ITAR-controlled programs. Dr. Trevorrow, as founder and CEO, has been intimately involved in VPI's defense business since its inception and has personal knowledge of VPI's product lines, customer relationships, and technical capabilities. Ms. Sung-Avila, as President and COO, oversees VPI's day-to-day operations, including manufacturing operations at the Albuquerque facility. Their continued involvement ensures that VPI's defense operations are managed by individuals with deep institutional knowledge and the requisite security clearances.
Looking beyond the initial 24-month period, any future change in VPI's designated ITAR empowered official or in other key ITAR compliance officers will require a separate notification to DDTC under § 122.4(a) as a further material change to VPI's registration information. VPI should establish internal protocols to ensure that any such changes are identified and reported to DDTC within the required timeframe. The compliance monitor, Whitmore Compliance Group LLC, should also be tasked with monitoring personnel changes that may trigger DDTC notification requirements as part of its ongoing compliance assessment activities.
IX. Recommended Timeline and Action Items
A. Pre-Closing Preparation
The following action items should be completed prior to the targeted closing date of February 9, 2024:
1. Draft ITAR § 122.4(a) Notification Letter. David Caruso and Priya Venkataraman will prepare a draft of the ITAR § 122.4(a) notification letter, including all supporting documentation identified in Section III.D above. Target completion of initial draft: December 15, 2023. Target completion of final draft (incorporating comments from all stakeholders): January 31, 2024.
2. Coordinate with VPI Outside Counsel. Coordinate with Wethersfield & Gale LLP (Harrison Whitfield, Sandra Niehaus, and Tobias Kwan), who represent VPI in connection with the transaction, to obtain all VPI-side information required for the notification, including current registration details, officer information, facility information, and any historical DDTC correspondence relevant to the notification.
3. Confirm VPI's Current Registration Status and Renewal Date. Contact DDTC to confirm VPI's current registration status, the date of the most recent renewal, and the next renewal

MEMORANDUM

Record

Parties

Dates

Amounts