1032-00004 · Client 1032 · NSA Negotiation

nsa-negotiation-strategy-memo.docx DOCUMENT M&A / Corporate

63 / 79 ← → ✕

MEMORANDUM

PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT

TO: Beatrice Holloway, Responsible Partner, Mergers & Acquisitions Lt. Col. (Ret.) David Caruso, Senior Counsel, Government Contracts & Export Controls

FROM: Margaret "Peggy" Ashworth, Of Counsel, National Security & CFIUS Priya Venkataraman, Associate, International Trade & Sanctions

DATE: November 7, 2023

RE: Halcyon Semiconductor AG / Marlowe Asset Management Photonics Inc. — National Security Agreement Negotiation: Priority Issues, HSAG Positions, Red Lines, and Fallback Positions

CFIUS Case No.: CFIUS-023-07-3841

Matter No.: 1032-00004

Right-click to update Table of Contents

I. Executive Summary

This memorandum has been prepared by the Calderwood & Harkness LLP national security and international trade team for the purpose of preparing the firm's negotiation team in advance of the first National Security Agreement ("NSA") negotiation session, currently scheduled for November 9, 2023, at the offices of the U.S. Department of the Treasury, 1500 Pennsylvania Avenue NW, Washington, D.C. The session follows the Committee on Foreign Investment in the United States ("CFIUS") circulation to the parties of an initial draft NSA on November 3, 2023.

As background, CFIUS communicated four preliminary national security concerns to the parties by letter dated October 20, 2023. Those concerns are: (1) the risk of foreign access to classified defense programs in which Marlowe Asset Management Photonics Inc. ("VPI") participates or has participated; (2) the potential transfer of International Traffic in Arms Regulations ("ITAR") and Export Administration Regulations ("EAR")-controlled technology to non-U.S. persons, including employees and affiliates of Halcyon Semiconductor Aktiengesellschaft ("HSAG"); (3) cybersecurity risks arising from the integration of VPI's information technology systems with HSAG's global IT infrastructure; and (4) the continuity and security of critical U.S. Department of Defense ("DoD") supply chain activities for gallium nitride ("GaN") power amplifier components. These concerns track closely with CFIUS's published guidance and the agency's pattern of mitigation in prior semiconductor-sector transactions.

The draft NSA is a 47-page agreement, exclusive of annexes and exhibits, to be entered into by and among Halcyon Semiconductor Aktiengesellschaft, Halcyon US Holdings Inc. (the Delaware acquisition vehicle), Marlowe Asset Management Photonics Inc. (the target), and the United States of America, acting through the Department of the Treasury, the Department of Defense, and the Department of Energy ("DOE"). The agreement is structured as a conventional mitigation agreement with governance, technology control, monitoring, personnel, cybersecurity, penalty, and term provisions.

This memorandum identifies eight priority negotiation issues arising from the draft NSA, provides a detailed analysis of CFIUS's initial positions as reflected in the draft, sets forth HSAG's preferred positions on each issue, identifies "red lines" — i.e., positions that HSAG should treat as non-negotiable — and proposes fallback and compromise positions for use as negotiations progress. The analysis draws extensively on the Comparative NSA Precedent Analysis prepared by this team, which surveys twelve recent NSAs in semiconductor-sector CFIUS transactions executed between 2019 and 2023. That benchmarking analysis has been provided separately and is referenced throughout this memorandum as a supporting resource.

The overall strategic objectives for this negotiation are fourfold:

1. Secure CFIUS clearance with mitigation terms that are commercially viable for HSAG and do not render the acquisition uneconomic.

2. Preserve the operational value of VPI — a $1.42 billion acquisition — by maintaining VPI's ability to perform on its existing government contracts and pursue new program opportunities.

3. Protect HSAG's ability to realize commercial synergies from the acquisition, particularly in the area of non-defense 5G infrastructure GaN technology, which was a core component of the strategic rationale presented to HSAG's supervisory board.

4. Maintain VPI's $193 million government contract backlog and position VPI for the CY2024 and CY2025 earnout milestones (up to $85 million in aggregate), which are conditioned upon achievement of government-contract revenue targets.

The negotiation counterparts for the November 9 session include CFIUS staff from the co-lead agencies, DoD and DOE, with Treasury chairing. The parties' counsel includes Harrison Whitfield of Wethersfield & Gale LLP, counsel to the sellers, who holds an active SECRET clearance and has been cooperating with Calderwood & Harkness on the joint filing throughout the review and investigation process. Mr. Whitfield's familiarity with CFIUS personnel and processes, and his credibility with the national security agencies, is a strategic asset that should be leveraged throughout the negotiation, as discussed further in Section XI below.

II. Transaction Background (Brief Summary)

The following summary is provided for reference and context. The full transaction description is set forth in the parties' joint voluntary notice filed with CFIUS on July 14, 2023, and in the supplemental information submissions dated August 11 and September 22, 2023.

A. Transaction Structure and Consideration

HSAG is acquiring 100% of the outstanding equity of VPI for aggregate cash consideration of $1.42 billion, on a cash-free, debt-free basis, subject to a net working capital adjustment with a target of $34.6 million. In addition to the fixed purchase price, the Stock Purchase Agreement ("SPA") provides for a potential earnout of up to $85 million, consisting of $50 million payable upon achievement of a CY2024 government-contract revenue milestone and $35 million payable upon achievement of a CY2025 government-contract revenue milestone. Maximum aggregate consideration under the SPA is therefore $1.505 billion. The acquisition will be effected through Halcyon US Holdings Inc., a Delaware C-corporation formed on June 5, 2023 (EIN 93-2841067), which will serve as the direct parent of VPI following the closing.

B. Financing. The acquisition is financed through a combination of debt and equity. The debt component consists of a $900 million senior secured term loan from a syndicate led by Meridian National Bank (administrative agent), with Atlas Commercial Lending AG and Pacific Basin Credit Corp. as co-lead arrangers. The equity component consists of a $520 million contribution from HSAG, funded through a combination of balance sheet cash and an approximately €300 million draw on HSAG's existing revolving credit facility with Rheinische Handelsbank AG. The financing commitments are subject to customary conditions, including the condition that the acquisition receive CFIUS clearance or that CFIUS's jurisdiction has been waived. The term loan commitment expiration date and any extension provisions should be confirmed by the M&A team in light of the current closing timeline analysis set forth in Section XI.C below.

C. VPI Profile

VPI is a Delaware C-corporation, incorporated on February 14, 2009, and headquartered in Colorado Springs, Colorado. VPI is a leading U.S. producer of gallium nitride-on-silicon carbide ("GaN-on-SiC") power amplifier chips used in defense radar systems, satellite communications ("satcom"), and 5G wireless infrastructure. VPI operates a 45,000-square-foot GaN-on-SiC fabrication facility located at 9200 Innovation Boulevard, Albuquerque, New Mexico, which holds a facility clearance ("FCL") at the SECRET level and is assigned CAGE Code 7VK92 by the Defense Logistics Agency.

VPI employs 486 individuals, of whom 212 (approximately 43.6%) hold active personnel security clearances at the SECRET or TS/SCI level. VPI currently maintains 14 active DoD contracts, with a combined backlog of approximately $193 million. VPI manufactures ITAR-controlled defense articles under Category XI(a)(3) of the United States Munitions List and produces items classified under EAR Export Control Classification Numbers ("ECCNs") 3A001, 3A991, and 3E001. VPI maintains an active registration with the Directorate of Defense Trade Controls ("DDTC") under Registration No. M-24817.

VPI's intellectual property portfolio consists of 47 granted U.S. patents, 12 pending patent applications, and 31 registered trade secrets relating to proprietary GaN epitaxial growth processes, power amplifier circuit architectures, and thermal management technologies.

Key VPI personnel relevant to this negotiation include:

• Dr. Nathan Trevorrow, Chief Executive Officer, who holds a TS/SCI clearance and has served as VPI's CEO since 2016.

• Marissa Sung-Avila, Chief Operating Officer, who holds a SECRET clearance and oversees VPI's manufacturing operations and supply chain.

• Col. (Ret.) Bryce Hendrickson, Vice President of Government Programs and Facility Security Officer ("FSO"), who holds a TS/SCI clearance and has served as VPI's FSO since 2018. Col. Hendrickson previously served 26 years in the U.S. Army signal corps.

• Derek Wainsborough, Chief Financial Officer, who does not hold a security clearance and manages VPI's financial reporting and treasury functions.

D. HSAG Profile

HSAG is an Aktiengesellschaft listed on the Frankfurt Stock Exchange (XETRA: HLC), headquartered in Dresden, Germany. As of June 1, 2023, HSAG had a market capitalization of approximately €14.8 billion. HSAG reported FY2022 revenue of €6.12 billion and EBITDA of €1.37 billion, making it one of the largest semiconductor manufacturers in Europe, with particular strength in power semiconductors, automotive electronics, and industrial sensors.

HSAG's existing U.S. operations are conducted through Halcyon US Inc., a wholly-owned subsidiary based in Austin, Texas. Halcyon US Inc. is a fabless design center employing approximately 320 individuals. Halcyon US Inc. does not perform classified work and does not hold a facility clearance.

HSAG also maintains a subsidiary in China — Halcyon Semiconductor (Shanghai) Co., Ltd. — which recorded revenue of approximately $81.4 million in FY2022 (approximately 1.3% of HSAG's consolidated revenue). The Shanghai subsidiary does not engage in GaN technology development, defense-related activities, or any work involving ITAR- or EAR-controlled items. The existence and activities of the Shanghai subsidiary have been disclosed in detail in the CFIUS filing and supplemental submissions.

E. Procedural History

The SPA was executed on June 10, 2023. The parties filed a voluntary joint notice with CFIUS on July 14, 2023. CFIUS's 45-day initial review period commenced on July 21, 2023, following acceptance of the filing. On September 4, 2023, CFIUS initiated a 45-day investigation, indicating that the Committee had identified national security considerations that could not be resolved during the initial review period. CFIUS communicated its four preliminary national security concerns by letter dated October 20, 2023. The initial draft NSA was circulated to the parties on November 3, 2023. Closing of the acquisition is expressly conditioned on CFIUS clearance pursuant to SPA §7.1(c).

III. Issue 1: Board Composition and Security Board Member Qualifications

A. CFIUS Draft Position

The draft NSA (§§3.1–3.9 and Annex A) requires that VPI's board of directors be reconstituted immediately upon closing to consist of five members: three "Security Board Members" and two HSAG designees. The CFIUS draft imposes the following requirements on this governance structure:

• All three Security Board Members must be U.S. citizens who currently hold, or are eligible to obtain, security clearances at the TS/SCI level.

• One of the three Security Board Members must be designated as an "independent Security Director." The independent Security Director may not be a current or former employee of either HSAG or VPI, may not be a shareholder of either entity, and must possess prior U.S. government national security experience (defined in the draft as at least ten years of service in a U.S. national security agency or in a cleared defense contractor in a security-related role).

• HSAG's two designees may not hold, access, or be briefed on classified information or ITAR-controlled technical data.

• CFIUS retains approval rights over the appointment and replacement of all Security Board Members, including the independent Security Director. The draft provides no corresponding role for HSAG in the selection of the independent Security Director.

• The three Security Board Members collectively constitute the "Government Security Committee" ("GSC"), which is vested with exclusive authority over all matters touching classified programs, ITAR-controlled articles, and any interaction with U.S. government customers. The Security Board Members have veto rights over any board action that implicates these matters.

B. HSAG Preferred Position

HSAG is prepared to accept the fundamental structure of a five-member board with three Security Board Members and two HSAG designees. This structure is consistent with the majority of semiconductor-sector NSA precedents and reflects an appropriate balance between national security oversight and the acquiror's legitimate interest in governing its subsidiary. Specifically, HSAG's preferred position includes the following elements:

1. Clearance Level. HSAG requests that Security Board Members need only hold, or be eligible for, security clearances at the SECRET level, rather than TS/SCI. This request is grounded in the fact that VPI's FCL is at the SECRET level. VPI does not currently hold a TOP SECRET facility clearance, and none of VPI's current classified programs require access to TS/SCI information at the board level. While certain individual VPI employees (including Dr. Trevorrow and Col. Hendrickson) hold TS/SCI clearances for purposes of specific program access, board-level governance of VPI's classified activities does not necessitate TS/SCI access for all three Security Board Members. Requiring TS/SCI for all Security Board Members would unnecessarily narrow the pool of qualified candidates and may delay board constitution.

2. HSAG Designee Access. HSAG's two designees should have full and unrestricted access to all unclassified VPI business information, including financial data, operational metrics, customer pipeline information (for unclassified programs), and commercial (non-ITAR) technical information. This access is essential for HSAG to exercise its ownership rights, fulfill its fiduciary obligations under German corporate law, and comply with its IFRS consolidated financial reporting requirements.

3. Independent Security Director Selection. The independent Security Director should be mutually agreed upon by HSAG and CFIUS, rather than unilaterally selected by CFIUS. HSAG acknowledges CFIUS's legitimate interest in ensuring that the independent Security Director possesses appropriate qualifications and experience. However, HSAG — as the entity bearing the cost of the Security Director's compensation and as VPI's ultimate owner — should have a meaningful role in the selection process, including the right to propose candidates and to object to candidates on reasonable grounds. A mutual-agreement mechanism is consistent with five of the twelve precedent NSAs in our benchmarking analysis.

4. Proposed Candidates. HSAG proposes Col. (Ret.) Bryce Hendrickson (current TS/SCI clearance holder and FSO) and Adrienne Delacroix (current SECRET clearance holder, former Deputy Director of the Defense Technology Security Administration, 22 years of DoD experience) as two of the three Security Board Members. HSAG would work with CFIUS to identify a mutually acceptable independent Security Director as the third member.

5. Financial Reporting Access. HSAG designees should have access to aggregated, unclassified financial information about VPI's classified programs — specifically, revenue, cost of goods sold, gross margin, and operating margin data, presented in aggregate across all classified programs without program-specific detail. This access is necessary for HSAG to prepare consolidated financial statements in compliance with IFRS and to report to its supervisory board and shareholders on the performance of the VPI subsidiary. Denial of this information would create a material gap in HSAG's financial reporting and potentially trigger disclosure issues with German securities regulators (BaFin).

C. Red Lines

The following positions are non-negotiable for HSAG:

• Minimum Board Representation. HSAG must retain at least two designees on VPI's board of directors. HSAG cannot accept a board structure in which it has fewer than two seats. A minority position of one seat or zero seats would effectively strip HSAG of any governance role in a $1.42 billion subsidiary, would be inconsistent with HSAG's rights and obligations as VPI's sole indirect shareholder, and would be unprecedented in our review of comparable NSAs.

• Unclassified Information Access. HSAG designees must have unrestricted access to all unclassified business and financial information of VPI. Any restriction on access to unclassified information would impair HSAG's ability to manage VPI as a subsidiary, to meet its own regulatory reporting obligations, and to realize the commercial value of the acquisition.

• Designee Removal. HSAG will not accept a provision granting CFIUS unilateral authority to remove and replace HSAG's board designees. HSAG acknowledges that CFIUS may have legitimate concerns about specific individuals in extraordinary circumstances (e.g., a designee who is found to pose a counterintelligence risk), and HSAG is prepared to discuss a process for addressing such circumstances. However, a blanket unilateral removal authority is inconsistent with basic corporate governance principles and the acquiror's ownership rights.

D. Fallback Positions

If CFIUS is unwilling to accept HSAG's preferred positions, the following fallback positions are authorized:

• TS/SCI Requirement. HSAG is prepared to accept a TS/SCI clearance requirement for all three Security Board Members if CFIUS insists, provided that CFIUS acknowledges the practical implications. Col. Hendrickson already holds a TS/SCI clearance. Ms. Delacroix currently holds a SECRET clearance but has prior TS/SCI access and could be upgraded through a reinvestigation process. HSAG would need adequate time (estimated 6–12 months) to complete the upgrade, and interim provisions (e.g., a provisional board composition with SECRET-cleared members pending TS/SCI adjudication) should be included in the NSA.

• Independent Security Director Selection. HSAG is prepared to accept CFIUS approval authority (rather than mutual agreement) for the independent Security Director, provided that HSAG retains the right to propose candidates. A provision requiring CFIUS to consider and respond to HSAG-proposed candidates within a defined time frame (e.g., 30 days) would address HSAG's concerns about being excluded from the process.

• Classified Program Financial Information. HSAG is prepared to accept that HSAG designees receive only aggregated financial summaries for classified programs — presenting revenue, margin, and backlog data across all classified programs in a single line item — with no program-specific detail, no contract numbers, no customer agency identification, and no technical description of program scope. This represents the minimum information necessary for consolidated financial reporting.

IV. Issue 2: Technology Access and TCP Scope

A. CFIUS Draft Position

The draft NSA (§§4.1–4.14 and Annex B) requires the establishment of a comprehensive Technology Control Plan ("TCP") governing all transfers of VPI technical data. The CFIUS draft defines "technical data" broadly to encompass all ITAR-controlled data falling under Category XI(a)(3) of the United States Munitions List and all EAR-controlled data classified under ECCNs 3A001, 3A991, and 3E001, as well as all "derivative" technical data — defined as any data derived from, based upon, or incorporating controlled technical data. The TCP provisions include the following key elements:

• The TCP prohibits any transfer of VPI technical data, as broadly defined, to any "non-U.S. person" — a term that encompasses HSAG employees, HSAG affiliates (including Halcyon US Inc. employees who are not U.S. persons), and any third party outside the United States — without prior written authorization from both the GSC and the relevant U.S. government licensing authority.

• The TCP applies to all VPI intellectual property, including the 47 granted U.S. patents, 12 pending patent applications, 31 registered trade secrets, and all derivative technical data generated by VPI.

• The draft prohibits any shared research and development activities between VPI and HSAG (or any HSAG affiliate) that involve "controlled technical data," defined to include any technical data that falls within the scope of the TCP.

• The draft prohibits the co-location of HSAG engineering personnel and VPI engineering personnel on any project involving "controlled items," broadly defined.

• The draft includes an absolute prohibition on the export of any VPI technical data to HSAG's Dresden headquarters, the Shanghai subsidiary, or any other non-U.S. HSAG facility.

B. HSAG Preferred Position

HSAG accepts the fundamental principle that a Technology Control Plan is an appropriate mitigation measure and acknowledges CFIUS's legitimate interest in preventing unauthorized transfers of defense-related and export-controlled technology. However, HSAG has significant concerns about the breadth of the TCP as drafted, which, if accepted without modification, would effectively prevent HSAG from realizing any of the commercial technology synergies that are a central component of the acquisition rationale. HSAG's preferred position is as follows:

1. Narrowed Definition of Controlled Technical Data. The definition of "controlled technical data" should be narrowed to encompass only items that are actually controlled under ITAR Category XI(a)(3) and EAR ECCNs 3A001 and 3E001. The current draft's inclusion of ECCN 3A991 in the controlled-data definition is overbroad, as 3A991 items are subject to only limited export controls (Anti-Terrorism reasons only) and are widely available commercially. More fundamentally, the draft's catch-all reference to "derivative" technical data, without limitation, could sweep in virtually all of VPI's technical knowledge, including purely commercial technologies that have no defense application and are not subject to export controls.

2. Controlled/Uncontrolled Distinction. The TCP should clearly distinguish between controlled and non-controlled VPI technology. VPI's product portfolio includes a significant body of purely commercial 5G wireless infrastructure technology — including power amplifier designs for commercial base stations, thermal management techniques for commercial applications, and GaN epitaxial growth processes optimized for commercial specifications — that is not defense-related, is not listed on the USML, is not classified under restrictive EAR ECCNs, and is commercially available from multiple global sources. This commercial technology should be freely shareable with HSAG for the purpose of realizing commercial synergies. The inability to share this technology would eliminate a substantial portion of the projected synergy value underpinning the $1.42 billion purchase price.

3. Joint R&D for Commercial Technology. The TCP should permit joint research and development activities between VPI and Halcyon US Inc. (the Austin, Texas design center) on uncontrolled commercial GaN technology, subject to appropriate screening procedures to ensure that controlled technical data is not inadvertently included. The Austin facility does not hold a facility clearance and does not perform classified work; joint R&D at that facility on commercial technology presents minimal national security risk.

4. Government-Licensed Technology. Of VPI's 47 granted patents, 23 were developed under government-funded contracts and are subject to march-in rights under 35 U.S.C. §203 and the rights provisions of DFARS 252.227-7038. The U.S. government already holds license rights to the technical data underlying these patents. TCP restrictions should focus on genuinely proprietary VPI technology that is not already accessible to the U.S. government through existing license rights. The application of TCP restrictions to technology that the government itself can use and disclose is duplicative and suggests an overbroad scope.

5. Existing Export Licenses. VPI currently holds valid DSP-5 licenses for deliveries of certain defense articles to the United Kingdom and Australia, both of which are close U.S. allies and members of the Five Eyes intelligence-sharing community. The TCP should not impede VPI's ability to fulfill obligations under these existing export licenses. VPI's ability to perform on its foreign military sales and direct commercial sales to allied nations is an important component of VPI's revenue base and contributes to the government contract backlog that CFIUS itself has identified as a national security interest.

C. Red Lines

The following positions are non-negotiable:

• Overbroad TCP. HSAG cannot accept a TCP that treats all VPI technology as controlled — including purely commercial, non-defense, non-export-controlled technology. Such a TCP would eliminate virtually all commercial synergy value from the $1.42 billion acquisition and would render the transaction uneconomic. HSAG's supervisory board approved this acquisition on the basis of a business case that projected approximately €180 million in cumulative commercial technology synergies over the first five years post-closing. A TCP that prevents any sharing of commercial technology would reduce those synergies to zero.

• Commercial Technology Sharing. HSAG must retain the ability to share non-ITAR, non-EAR-controlled commercial technology with its global operations, including its Dresden headquarters and the Austin design center. HSAG acknowledges that sharing with the Shanghai subsidiary raises distinct concerns (addressed in the fallback positions below) and is prepared to accept restrictions specific to China.

D. Fallback Positions

If CFIUS is unwilling to accept HSAG's preferred position on TCP scope, the following fallback positions are authorized:

• Technology Release Determination Mechanism. HSAG is prepared to accept a broad TCP initially — encompassing all VPI technical data — provided that the NSA includes a defined mechanism for HSAG to request "technology release determinations" from the GSC on a case-by-case basis for specific items of non-controlled technology. Under this mechanism, HSAG would submit a written request identifying the specific technology, its export control classification (or lack thereof), and the intended use and recipient. The GSC would have a defined period (HSAG proposes 30 business days) to review the request and issue a determination. If the GSC determines that the technology is not controlled under ITAR or restricted EAR ECCNs, the technology would be released from TCP restrictions. This approach gives CFIUS the initial broad protection it seeks while providing HSAG a pathway to unlock commercial synergy value over time.

• China-Specific Carve-Out. HSAG is prepared to accept a prohibition on sharing any VPI technology — including non-controlled commercial technology — with Halcyon Semiconductor (Shanghai) Co., Ltd. specifically. This represents a significant concession, as it would prevent HSAG from leveraging any VPI technology in its Chinese operations, even for purely commercial purposes. However, HSAG recognizes that the presence of the Shanghai subsidiary is likely a significant concern for CFIUS, particularly for DoD and DOE, and that a blanket prohibition on technology sharing with the Chinese entity may be necessary to resolve this concern definitively.

• Implementation Period. HSAG is prepared to accept a six-month implementation period for the TCP following closing, during which interim restrictions would apply. The interim restrictions would prohibit any transfer of ITAR-controlled or classified technical data to non-U.S. persons but would permit continued operation of existing commercial technology-sharing arrangements pending full TCP implementation. This phased approach acknowledges the operational complexity of establishing a comprehensive TCP and the need for careful classification of VPI's technology portfolio.

• Reclassification Review. HSAG proposes that the six items identified by Christy Bauer (VPI's export control officer) in her October 2, 2023 memorandum as requiring reclassification review under the EAR be resolved before the TCP's scope is finalized. Three of these items may not warrant classification under ECCN 3A001, and their reclassification to EAR99 would remove them from TCP coverage. Including these items in the TCP without first resolving their classification status would result in unnecessary restrictions.

V. Issue 3: Monitor Scope and Independence

A. CFIUS Draft Position

The draft NSA (§§6.1–6.15 and Annex D) establishes a comprehensive third-party compliance monitoring regime with the following principal elements:

• A third-party compliance monitor (the "Monitor") is to be appointed, with broad access to all VPI facilities, all HSAG U.S. facilities, all personnel of both entities, all records (including electronic records, correspondence, and communications), and all systems.

• The Monitor reports directly to the CFIUS monitoring agencies — specifically, the Defense Counterintelligence and Security Agency ("DCSA"), the Department of the Treasury, the Department of Defense, and the Department of Energy — and does not report to, or take direction from, HSAG or VPI.

• The Monitor has authority to conduct unannounced inspections of VPI and HSAG U.S. facilities at any time during normal business hours, without prior notice to the parties.

• The Monitor has authority to investigate any "potential violation" of the NSA and to compel the production of documents, records, and information from VPI, HSAG, and their respective employees and agents.

• The Monitor's scope of activities includes: (i) annual comprehensive compliance audits covering all NSA obligations; (ii) quarterly spot checks on specific compliance areas; (iii) ad hoc investigations triggered by reported incidents, tips, or other indicia of non-compliance; and (iv) ongoing review of all HSAG-VPI communications, including emails, shared documents, and meeting records.

• The Monitor is appointed for an indefinite term, coterminous with the NSA itself (which, under the CFIUS draft, has no expiration date — see Issue 8).

• DCSA is designated as the primary monitoring agency responsible for day-to-day oversight of VPI's compliance.

B. HSAG Preferred Position

HSAG accepts the concept of a third-party compliance monitor as an appropriate component of the mitigation framework. Third-party monitoring is standard in semiconductor-sector NSAs, appearing in eleven of the twelve precedent agreements in our benchmarking analysis. However, the scope and modalities of the monitoring regime must be defined with sufficient precision to protect legitimate business interests, prevent undue operational disruption, and ensure that monitoring is focused on NSA-relevant compliance rather than serving as an open-ended investigative mandate. HSAG's preferred position includes:

1. Scope of Access. The Monitor's access should be limited to VPI facilities and VPI personnel, and to those HSAG U.S. personnel who interact with VPI in connection with matters covered by the NSA (e.g., HSAG designees on VPI's board, HSAG personnel involved in financial reporting or IT administration). The Monitor should not have access to HSAG's German headquarters, non-U.S. operations, or HSAG facilities and personnel that have no connection to VPI. The draft's grant of access to "all HSAG U.S. facilities" is overbroad, as HSAG's Austin design center (Halcyon US Inc.) conducts purely commercial semiconductor design work unrelated to VPI's defense activities.

2. Audit Frequency. HSAG proposes that the Monitor conduct one annual comprehensive compliance audit and one mid-year spot check per year, rather than the quarterly spot checks contemplated by the CFIUS draft. A quarterly cycle imposes significant operational burden on VPI personnel, who must devote substantial time to preparing for and participating in Monitor visits, and the incremental compliance value of quarterly (versus semi-annual) reviews is marginal in a well-designed monitoring program.

3. Inspection Notice. HSAG requests that all Monitor visits be conducted with at least 48 hours' advance notice, except in emergency circumstances where the CFIUS monitoring agencies have identified a specific, credible threat or indication of a violation. Unannounced inspections are disruptive to VPI's manufacturing operations — the Albuquerque fab operates on a continuous production schedule for defense-grade wafers, and unplanned facility access events can affect cleanroom integrity, production yields, and delivery schedules on active DoD contracts. A 48-hour notice requirement still provides the Monitor with ample opportunity to conduct meaningful compliance reviews while minimizing operational disruption.

4. Report Sharing. Monitor reports should be simultaneously shared with HSAG (through Calderwood & Harkness as HSAG's U.S. counsel) to allow HSAG to review the Monitor's findings and submit a written response or rebuttal before the report is finalized and submitted to CFIUS agencies. This is a matter of fundamental fairness: the monitored parties should have the opportunity to correct factual errors, provide context for the Monitor's observations, and present evidence of remedial actions taken, before a report is presented to CFIUS as a final product. Simultaneous sharing is provided for in four of the twelve precedent NSAs.

5. Monitor Selection. HSAG proposes Whitmore Compliance Group LLC ("WCG") as the third-party Monitor. WCG is led by Gerald Whitmore, a former supervisory special agent of the FBI's Counterintelligence Division, who holds a TS/SCI clearance and has extensive experience serving as a compliance monitor in CFIUS mitigation agreements, including three semiconductor-sector NSAs executed between 2020 and 2023. WCG is located at 1300 Crystal Drive, Suite 710, Arlington, Virginia 22202. WCG has been vetted by Calderwood & Harkness and is experienced in the specific compliance issues arising under semiconductor-sector NSAs, including TCP implementation, cybersecurity monitoring, and classified program oversight. Early identification and vetting of a proposed Monitor accelerates the NSA implementation process and reduces the risk of post-closing delays.

6. Monitor Term. The Monitor's engagement should align with the term of the NSA. The draft's reference to an "indefinite" Monitor engagement is a function of the indefinite NSA term and should be addressed as part of the term/sunset discussion (Issue 8). In any event, the Monitor engagement agreement should include provisions for periodic performance reviews and, if warranted, replacement of the Monitor by mutual agreement of the parties and CFIUS.

C. Red Lines

The following positions are non-negotiable:

• Global Corporate Systems. The Monitor must not have access to HSAG's global corporate systems, trade secrets, or proprietary technology unrelated to VPI. The Monitor's mandate is to verify compliance with the NSA's terms as they relate to VPI and HSAG's interactions with VPI. Extending the Monitor's access to HSAG's unrelated global operations would expose HSAG's proprietary commercial information to potential disclosure, would raise data privacy issues under EU law (including the General Data Protection Regulation), and would exceed the scope of CFIUS's statutory authority.

• Document Production Standard. The Monitor's authority to "compel" production of documents must be subject to a reasonableness limitation. The Monitor should be authorized to request and obtain documents that are relevant to NSA compliance — not documents unrelated to VPI's defense activities or HSAG's obligations under the NSA. The draft's unlimited compulsion authority could be used to demand production of HSAG's global corporate records, strategic plans, and proprietary business information, which is inappropriate.

• Report Access. HSAG must receive copies of all Monitor reports and have an opportunity to submit a written response or rebuttal before reports are finalized. HSAG cannot accept a monitoring regime in which reports are submitted to CFIUS agencies without the monitored parties' knowledge or input. At minimum, HSAG must receive each report contemporaneously with its submission to CFIUS.

D. Fallback Positions

• Quarterly Spot Checks. If CFIUS insists on quarterly spot checks (rather than semi-annual), HSAG is prepared to accept this frequency provided that each quarterly spot check is limited to a focused compliance area (e.g., Q1: TCP compliance; Q2: cybersecurity; Q3: facility access logs and personnel clearance status; Q4: financial reporting and board governance) rather than a comprehensive review. Focused quarterly reviews would reduce the operational burden while maintaining the cadence CFIUS seeks.

• Report Sharing Timing. If CFIUS is unwilling to accept simultaneous report sharing, HSAG is prepared to accept a provision under which Monitor reports are submitted directly to CFIUS agencies, but HSAG receives a copy within five business days of submission, together with the right to submit a written response within ten business days of receipt. CFIUS agencies would be obligated to consider HSAG's response before taking any action based on the Monitor's findings.

• Unannounced Inspections. If CFIUS insists on retaining unannounced inspection authority, HSAG is prepared to accept unannounced inspections limited to the Albuquerque classified facility only (not VPI's Colorado Springs headquarters or HSAG's Austin facility), and subject to same-day telephonic notice to HSAG's U.S. counsel (Calderwood & Harkness LLP, Attn: Margaret Ashworth). This compromise permits the government to maintain the element of surprise for classified-facility inspections while ensuring that HSAG's counsel is promptly informed.

VI. Issue 4: Cost Allocation for Monitor and Compliance

A. CFIUS Draft Position

The draft NSA (§§6.16–6.19) addresses cost allocation for monitoring and compliance as follows:

• All costs associated with the third-party Monitor — including fees, expenses, travel, and any other costs — are to be borne exclusively by HSAG (through VPI).

• The draft does not specify a fee amount or a fee structure; instead, it contemplates that the Monitor's fees will be set forth in a separate engagement agreement between the Monitor and VPI/HSAG, subject to CFIUS approval.

• All internal VPI compliance costs — including personnel costs for compliance officers and support staff, IT infrastructure costs for compliance systems, and training costs — are to be borne by VPI (and, therefore, indirectly by HSAG as VPI's post-closing owner).

• The draft does not expressly state that HSAG is responsible for the costs of CFIUS's own monitoring and enforcement activities (i.e., the internal costs incurred by DCSA, Treasury, DoD, and DOE in overseeing VPI's compliance). However, the absence of any limitation on HSAG's cost obligations, combined with the draft's broad language regarding "all costs associated with compliance with this Agreement," could be construed to include such costs.

B. HSAG Preferred Position

HSAG accepts that the acquiror bears the costs of the third-party Monitor, which is standard practice in CFIUS mitigation agreements. However, these costs must be defined with sufficient clarity and predictability to allow HSAG to budget and plan for them, and must be consistent with the costs borne by acquirors in comparable transactions. HSAG's preferred position includes:

1. Fixed Annual Fee. HSAG proposes to negotiate a fixed annual fee with the selected Monitor (WCG), targeting an annual fee in the range of $1.0 million to $1.2 million. This range is consistent with the precedent analysis of comparable semiconductor-sector NSAs, in which annual monitor fees ranged from $800,000 to $1.8 million, with a median of $1.1 million.

2. Payment Structure. HSAG proposes a quarterly payment structure, with payments of $250,000 to $300,000 per quarter, to facilitate cash flow management at the VPI subsidiary level and to align Monitor payments with VPI's quarterly financial reporting cycle.

3. Escalation. Annual fee adjustments should be limited to a Consumer Price Index ("CPI") adjustment, not subject to uncapped escalation at the Monitor's discretion. The engagement agreement should specify the CPI index to be used (HSAG proposes the U.S. Bureau of Labor Statistics CPI-U, All Urban Consumers) and should cap annual increases at the CPI change, with no minimum annual increase.

4. Government Costs. HSAG's cost obligations should be limited to the third-party Monitor's fees and expenses and VPI's internal compliance costs. HSAG should not bear the costs of CFIUS's own internal agency monitoring and enforcement activities, which are ordinary government operational costs funded through congressional appropriations. There is no statutory authority for CFIUS to charge the costs of its own personnel and operations to the monitored party.

5. Scope Reduction. The Monitor fee should be subject to renegotiation if the scope of monitoring is reduced or NSA obligations are narrowed over time (e.g., as a result of a periodic review under the term/sunset provisions discussed in Issue 8). A fixed fee negotiated at the outset of the NSA should not remain at the same level if the Monitor's workload is subsequently reduced due to demonstrated compliance and relaxation of monitoring intensity.

6. Tax Treatment. Internal compliance costs at VPI should be treated as ordinary and necessary business expenses and should be deductible for U.S. federal income tax purposes. While this is primarily a matter of VPI's tax position rather than an NSA drafting issue, the NSA should not contain any language that would characterize compliance costs as "penalties" or "fines" (which would be non-deductible under IRC §162(f)) rather than as costs of doing business.

C. Red Lines

• Annual Fee Cap. Total Monitor fees must not exceed $1.5 million per year, inclusive of CPI adjustments during the initial years of the NSA. An annual fee substantially in excess of this amount would be disproportionate to the scope of the monitoring program and would exceed the range observed in comparable precedent transactions. If CFIUS or the Monitor proposes fees above this threshold, HSAG would need to re-evaluate the overall economics of the transaction.

• Government Agency Costs. HSAG will not accept responsibility for the costs of CFIUS's internal government monitoring activities. There is no statutory basis for such a charge, and no precedent for it in the twelve semiconductor-sector NSAs reviewed.

D. Fallback Positions

• Fee Level. If CFIUS or the Monitor insists on a fee above $1.0 million, HSAG is prepared to accept $1.2 million per year ($300,000 per quarter) with CPI adjustment. This fee level aligns with the median of precedent benchmarks and reflects the moderate complexity of VPI's compliance profile (one cleared facility, 14 active DoD contracts, and a workforce with approximately 212 cleared individuals).

• Travel and Incidental Expenses. HSAG is prepared to accept that it bears the Monitor's travel and incidental expenses (airfare, lodging, meals, and local transportation for on-site visits) in addition to the fixed fee, provided that such expenses are subject to a reasonable annual cap. HSAG proposes a cap of $100,000 per year for travel and incidental expenses, with expenses above that amount requiring advance approval by HSAG.

VII. Issue 5: Personnel Retention Requirements

A. CFIUS Draft Position

The draft NSA (§§5.1–5.8) includes key personnel retention requirements with the following principal elements:

• Certain VPI personnel designated as "key personnel" must remain employed at VPI for a minimum period following the closing of the acquisition.

• "Key personnel" are defined as: (i) Dr. Nathan Trevorrow, Chief Executive Officer; (ii) Marissa Sung-Avila, Chief Operating Officer; and (iii) Col. (Ret.) Bryce Hendrickson, Vice President of Government Programs and Facility Security Officer.

• The minimum retention period is 36 months following the closing date.

• Any replacement of a key personnel member — whether due to termination, resignation, retirement, disability, or death — must be approved by both the GSC and DCSA before the replacement may assume the key personnel role.

• Termination of any key personnel member by HSAG or VPI (whether for cause or without cause) requires 60 days' advance written notice to both CFIUS and DCSA before the termination takes effect.

B. HSAG Preferred Position

HSAG accepts the concept of key personnel retention provisions as a reasonable element of CFIUS mitigation. The continuity of experienced leadership at VPI — particularly individuals who hold security clearances and have established relationships with DoD program offices — is important for maintaining VPI's government contract performance and its facility clearance. HSAG's preferred position is as follows:

1. Retention Period. HSAG proposes that the mandatory retention period be set at 18 months, rather than 36 months. An 18-month period provides sufficient time for HSAG to integrate VPI's operations, establish relationships with VPI's government customers, and develop a pipeline of successor candidates, while avoiding the operational and legal complications associated with an excessively long mandatory retention period.

2. Key Personnel Identification. HSAG accepts the identification of Dr. Trevorrow, Ms. Sung-Avila, and Col. Hendrickson as the three key personnel. These individuals were identified in VPI's CFIUS submission as holding the most critical roles for purposes of classified program management, facility security, and government customer relationships.

3. Voluntary Departures. Voluntary departures by key personnel (i.e., resignations initiated by the individual) should not constitute a violation of the NSA, provided that HSAG and VPI made good-faith, commercially reasonable efforts to retain the individual. The NSA should not impose strict liability for an event that is not within HSAG's control — specifically, an individual's decision to leave. Employment law principles, including the at-will employment doctrine, preclude an employer from compelling an individual to remain employed, and the NSA should not create an obligation that HSAG cannot lawfully fulfill.

4. Replacement Approval. The replacement approval process should be streamlined to require GSC approval only, with notification to DCSA. The dual-approval requirement (GSC plus DCSA) creates an unnecessary procedural burden that could delay the installation of qualified replacement personnel, which in turn could disrupt VPI's classified programs and government contract performance — the very outcome CFIUS is seeking to prevent.

5. Retirement and Disability. If a key personnel member retires or becomes disabled, the event should trigger a 90-day cure period during which HSAG and VPI must identify and obtain approval for a qualified replacement. Retirement or disability should not be treated as an immediate NSA violation, as these are foreseeable life events for which a reasonable remediation period is appropriate.

C. Red Lines

• Maximum Retention Period. The personnel retention period must not exceed 24 months. A 36-month mandatory retention period is commercially unreasonable, creates complications under employment law (particularly Colorado's non-compete and restrictive covenant statutes, which apply to VPI's Colorado Springs-based employees), and is at the outer edge of the precedent range observed in comparable NSAs. The median retention period in our benchmarking analysis is 24 months. HSAG's supervisory board has expressed concern about committing to retention obligations that may constrain VPI's ability to make management changes in response to performance issues.

• Commercially Reasonable Efforts Standard. HSAG cannot guarantee that any individual will choose to remain employed at VPI. The NSA must include a "commercially reasonable efforts" standard with a defined cure period for voluntary departures. Strict liability for an employee's decision to resign would be legally unenforceable and would expose HSAG to penalties for events beyond its control.

• FSO Priority. Col. Hendrickson's role as FSO is the most critical from CFIUS's perspective, as the FSO is the individual responsible for day-to-day oversight of VPI's compliance with the National Industrial Security Program Operating Manual ("NISPOM") and the facility clearance requirements. HSAG recognizes that CFIUS may seek enhanced protections for this role specifically, and HSAG is willing to negotiate enhanced provisions applicable to the FSO role (as distinct from the CEO and COO roles) to address CFIUS's concerns.

D. Fallback Positions

• 24-Month Compromise. HSAG is prepared to accept a 24-month retention period as a compromise between HSAG's preferred 18-month period and CFIUS's 36-month position. This aligns with the median of precedent benchmarks and provides adequate time for succession planning.

• Differentiated Approval. HSAG is prepared to accept dual approval (GSC plus DCSA) for the replacement of Col. Hendrickson specifically, given his FSO role and its direct relevance to facility security and DCSA oversight. For replacements of Dr. Trevorrow and Ms. Sung-Avila, HSAG proposes GSC-only approval with notification to DCSA.

• Notice Periods. HSAG is prepared to accept the 60-day advance notice requirement for terminations initiated by HSAG or VPI (i.e., employer-initiated separations). For voluntary departures (i.e., employee-initiated resignations), HSAG requests a reduced notice period of 30 days, as HSAG's ability to provide advance notice of a resignation is inherently limited by the timing of the employee's decision.

• Enhanced Retention Packages. As a practical mitigation measure separate from the NSA's legal requirements, HSAG proposes to implement enhanced retention packages ("golden handcuffs") for each of the three key personnel, to be structured in consultation with HSAG's human resources team and VPI's current employment counsel. These packages would include retention bonuses, accelerated equity vesting (or cash-equivalent awards), and enhanced severance provisions designed to incentivize each individual to remain at VPI through the mandatory retention period. The existence and terms of these packages would be disclosed to CFIUS as evidence of HSAG's good-faith commitment to personnel continuity, but the specific terms of the packages would not be incorporated into the NSA itself.

VIII. Issue 6: Cybersecurity Standards (NIST SP 800-171 vs. CMMC)

A. CFIUS Draft Position

The draft NSA (§§8.1–8.12 and Annex E) imposes comprehensive cybersecurity requirements on VPI, including:

• VPI must maintain compliance with NIST Special Publication 800-171, Revision 2, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations," for all covered defense information ("CDI") processed, stored, or transmitted by VPI systems.

• VPI must achieve Cybersecurity Maturity Model Certification ("CMMC") Level 2 certification within 12 months of the closing date.

• VPI must undergo annual third-party penetration testing by a firm approved by the Monitor, with results reported to the Monitor and DCSA.

• VPI must report any cybersecurity incident to DCSA within 24 hours of detection.

• The draft requires complete physical and logical separation of all VPI IT systems from HSAG's global network. Specifically, the draft prohibits any shared cloud infrastructure, shared email systems, shared virtual private network ("VPN") connections, shared data centers, or any other shared IT resource between VPI and HSAG or any HSAG affiliate.

• VPI must maintain a separate, U.S.-based IT team with no reporting relationship to HSAG IT leadership.

B. HSAG Preferred Position

HSAG acknowledges the importance of robust cybersecurity for VPI's classified and controlled defense information and is committed to maintaining and enhancing VPI's cybersecurity posture. VPI has invested substantially in its cybersecurity infrastructure and is already substantially compliant with NIST SP 800-171, as documented in VPI's System Security Plan and Plan of Actions and Milestones, both of which were provided to CFIUS in the supplemental submission of September 22, 2023. HSAG's preferred position is as follows:

1. NIST SP 800-171 Compliance. HSAG accepts the requirement to maintain VPI's compliance with NIST SP 800-171, Revision 2. VPI is already substantially compliant, with only seven open items on its current Plan of Actions and Milestones, all of which are scheduled for remediation by Q1 2024. Acceptance of this requirement is straightforward.

2. CMMC Level 2 Timeline. HSAG proposes that the CMMC Level 2 certification timeline be aligned with DoD's own CMMC program rollout schedule. The CMMC program has been subject to repeated delays; the final rule implementing CMMC 2.0 has not yet been published, the CMMC Accreditation Body ("The Cyber AB") is still in the process of certifying CMMC Third-Party Assessment Organizations ("C3PAOs"), and DoD has not yet begun including CMMC Level 2 requirements in new contract solicitations. Requiring VPI to achieve CMMC Level 2 certification within 12 months of closing — when the program infrastructure for third-party assessment may not yet be operational — is impractical. HSAG proposes a timeline of 24 months post-closing or upon the effective date of the CMMC final rule, whichever is later. This ensures that VPI pursues certification diligently while avoiding the imposition of a hard deadline tied to a standard that is not yet fully defined or operational.

3. Incident Reporting. HSAG proposes a 72-hour incident reporting window, rather than the 24-hour window in the CFIUS draft. A 72-hour reporting window is consistent with the existing DFARS 252.204-7012 clause ("Safeguarding Covered Defense Information and Cyber Incident Reporting"), which requires reporting of cyber incidents to the DoD Cyber Crime Center (DC3) within 72 hours of discovery. The 72-hour period allows VPI's cybersecurity team to detect the incident, conduct initial triage to confirm that a reportable event has occurred (as opposed to a false positive or a non-security event), assess the scope and severity of the incident, and prepare a meaningful initial report. A 24-hour window would likely result in premature, incomplete, and potentially misleading reports that create unnecessary alarm and consume DCSA resources.

4. IT Separation — Classified vs. Unclassified. HSAG accepts the requirement for complete physical and logical separation of VPI's classified IT systems and any systems processing ITAR- or EAR-controlled technical data from HSAG's global network. However, HSAG proposes that VPI be permitted to share unclassified enterprise resource planning ("ERP"), human resources ("HR"), and financial reporting systems with HSAG for the purpose of processing unclassified administrative data. This is essential for HSAG to meet its IFRS consolidated financial reporting obligations, to manage VPI's payroll and benefits through HSAG's global HR platform, and to integrate VPI into HSAG's enterprise-wide planning and budgeting processes. Shared administrative systems would process only unclassified data and would be architected with appropriate access controls and network segmentation.

5. IT Reporting Structure. HSAG proposes that VPI IT personnel be divided into two categories: (i) those with access to classified systems, who would report exclusively to the GSC and the FSO, and (ii) those responsible for unclassified administrative systems, who would maintain a primary reporting line to a VPI IT director with a dotted-line reporting relationship to HSAG IT for administrative and budgetary coordination purposes. This dual-reporting structure preserves the security of classified IT operations while enabling the operational efficiencies necessary for an effective parent-subsidiary relationship.

6. Penetration Testing. HSAG accepts the requirement for annual third-party penetration testing. However, HSAG proposes that VPI (through its IT security team and the GSC) select the penetration testing firm, subject to Monitor approval. The current draft's silence on the selection process implies that the Monitor selects the firm unilaterally, which could result in the selection of a firm unfamiliar with VPI's systems architecture or one that charges disproportionate fees. VPI's participation in the selection process ensures that the testing is conducted by a qualified firm with relevant experience.

C. Red Lines

• Incident Reporting Window. A 24-hour incident reporting window is operationally impractical and inconsistent with existing DoD reporting requirements under DFARS 252.204-7012. HSAG's minimum acceptable reporting window is 48 hours, with a strong preference for 72 hours. Detection, triage, and initial assessment of cybersecurity incidents — particularly sophisticated intrusions that may not trigger obvious indicators — require time. Premature reporting would generate noise and reduce the quality of reporting, ultimately undermining the effectiveness of the incident response framework.

• Unclassified Administrative Systems. Complete IT separation, including unclassified ERP and financial reporting systems, would cost an estimated $8 million to $12 million to implement (based on VPI's current IT architecture assessment prepared by Granite Harbor Advisors in August 2023) and would prevent HSAG from integrating VPI into its consolidated financial reporting and enterprise management systems. HSAG cannot accept complete separation for unclassified administrative systems. This is not merely a matter of convenience or cost savings; it is a fundamental requirement for HSAG's ability to manage VPI as a subsidiary and to comply with its own regulatory obligations.

• CMMC Timeline. HSAG cannot accept a hard deadline of 12 months for CMMC Level 2 certification when the CMMC program itself has not yet been fully implemented by DoD. Imposing a rigid timeline that requires compliance with a standard not yet operational creates the risk that VPI will be found in violation of the NSA through no fault of its own — because the assessment infrastructure does not yet exist to certify VPI's compliance. HSAG is committed to achieving CMMC Level 2 certification on a timeline aligned with the program's availability and will make commercially reasonable efforts to complete certification as expeditiously as practicable.

D. Fallback Positions

• 48-Hour Incident Reporting. As a compromise between the CFIUS draft's 24-hour requirement and HSAG's preferred 72-hour window, HSAG is prepared to accept a 48-hour incident reporting window. This provides sufficient time for initial triage and assessment while addressing CFIUS's interest in prompt notification.

• CMMC Timeline Compromise. HSAG proposes the following compromise

MEMORANDUM
PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
TO: Beatrice Holloway, Responsible Partner, Mergers & Acquisitions Lt. Col. (Ret.) David Caruso, Senior Counsel, Government Contracts & Export Controls
FROM: Margaret "Peggy" Ashworth, Of Counsel, National Security & CFIUS Priya Venkataraman, Associate, International Trade & Sanctions
DATE: November 7, 2023
RE: Halcyon Semiconductor AG / Marlowe Asset Management Photonics Inc. — National Security Agreement Negotiation: Priority Issues, HSAG Positions, Red Lines, and Fallback Positions
CFIUS Case No.: CFIUS-023-07-3841
Matter No.: 1032-00004
Right-click to update Table of Contents
I. Executive Summary
This memorandum has been prepared by the Calderwood & Harkness LLP national security and international trade team for the purpose of preparing the firm's negotiation team in advance of the first National Security Agreement ("NSA") negotiation session, currently scheduled for November 9, 2023, at the offices of the U.S. Department of the Treasury, 1500 Pennsylvania Avenue NW, Washington, D.C. The session follows the Committee on Foreign Investment in the United States ("CFIUS") circulation to the parties of an initial draft NSA on November 3, 2023.
As background, CFIUS communicated four preliminary national security concerns to the parties by letter dated October 20, 2023. Those concerns are: (1) the risk of foreign access to classified defense programs in which Marlowe Asset Management Photonics Inc. ("VPI") participates or has participated; (2) the potential transfer of International Traffic in Arms Regulations ("ITAR") and Export Administration Regulations ("EAR")-controlled technology to non-U.S. persons, including employees and affiliates of Halcyon Semiconductor Aktiengesellschaft ("HSAG"); (3) cybersecurity risks arising from the integration of VPI's information technology systems with HSAG's global IT infrastructure; and (4) the continuity and security of critical U.S. Department of Defense ("DoD") supply chain activities for gallium nitride ("GaN") power amplifier components. These concerns track closely with CFIUS's published guidance and the agency's pattern of mitigation in prior semiconductor-sector transactions.
The draft NSA is a 47-page agreement, exclusive of annexes and exhibits, to be entered into by and among Halcyon Semiconductor Aktiengesellschaft, Halcyon US Holdings Inc. (the Delaware acquisition vehicle), Marlowe Asset Management Photonics Inc. (the target), and the United States of America, acting through the Department of the Treasury, the Department of Defense, and the Department of Energy ("DOE"). The agreement is structured as a conventional mitigation agreement with governance, technology control, monitoring, personnel, cybersecurity, penalty, and term provisions.
This memorandum identifies eight priority negotiation issues arising from the draft NSA, provides a detailed analysis of CFIUS's initial positions as reflected in the draft, sets forth HSAG's preferred positions on each issue, identifies "red lines" — i.e., positions that HSAG should treat as non-negotiable — and proposes fallback and compromise positions for use as negotiations progress. The analysis draws extensively on the Comparative NSA Precedent Analysis prepared by this team, which surveys twelve recent NSAs in semiconductor-sector CFIUS transactions executed between 2019 and 2023. That benchmarking analysis has been provided separately and is referenced throughout this memorandum as a supporting resource.
The overall strategic objectives for this negotiation are fourfold:
1. Secure CFIUS clearance with mitigation terms that are commercially viable for HSAG and do not render the acquisition uneconomic.
2. Preserve the operational value of VPI — a $1.42 billion acquisition — by maintaining VPI's ability to perform on its existing government contracts and pursue new program opportunities.
3. Protect HSAG's ability to realize commercial synergies from the acquisition, particularly in the area of non-defense 5G infrastructure GaN technology, which was a core component of the strategic rationale presented to HSAG's supervisory board.
4. Maintain VPI's $193 million government contract backlog and position VPI for the CY2024 and CY2025 earnout milestones (up to $85 million in aggregate), which are conditioned upon achievement of government-contract revenue targets.
The negotiation counterparts for the November 9 session include CFIUS staff from the co-lead agencies, DoD and DOE, with Treasury chairing. The parties' counsel includes Harrison Whitfield of Wethersfield & Gale LLP, counsel to the sellers, who holds an active SECRET clearance and has been cooperating with Calderwood & Harkness on the joint filing throughout the review and investigation process. Mr. Whitfield's familiarity with CFIUS personnel and processes, and his credibility with the national security agencies, is a strategic asset that should be leveraged throughout the negotiation, as discussed further in Section XI below.
II. Transaction Background (Brief Summary)
The following summary is provided for reference and context. The full transaction description is set forth in the parties' joint voluntary notice filed with CFIUS on July 14, 2023, and in the supplemental information submissions dated August 11 and September 22, 2023.
A. Transaction Structure and Consideration
HSAG is acquiring 100% of the outstanding equity of VPI for aggregate cash consideration of $1.42 billion, on a cash-free, debt-free basis, subject to a net working capital adjustment with a target of $34.6 million. In addition to the fixed purchase price, the Stock Purchase Agreement ("SPA") provides for a potential earnout of up to $85 million, consisting of $50 million payable upon achievement of a CY2024 government-contract revenue milestone and $35 million payable upon achievement of a CY2025 government-contract revenue milestone. Maximum aggregate consideration under the SPA is therefore $1.505 billion. The acquisition will be effected through Halcyon US Holdings Inc., a Delaware C-corporation formed on June 5, 2023 (EIN 93-2841067), which will serve as the direct parent of VPI following the closing.
B. Financing. The acquisition is financed through a combination of debt and equity. The debt component consists of a $900 million senior secured term loan from a syndicate led by Meridian National Bank (administrative agent), with Atlas Commercial Lending AG and Pacific Basin Credit Corp. as co-lead arrangers. The equity component consists of a $520 million contribution from HSAG, funded through a combination of balance sheet cash and an approximately €300 million draw on HSAG's existing revolving credit facility with Rheinische Handelsbank AG. The financing commitments are subject to customary conditions, including the condition that the acquisition receive CFIUS clearance or that CFIUS's jurisdiction has been waived. The term loan commitment expiration date and any extension provisions should be confirmed by the M&A team in light of the current closing timeline analysis set forth in Section XI.C below.
C. VPI Profile
VPI is a Delaware C-corporation, incorporated on February 14, 2009, and headquartered in Colorado Springs, Colorado. VPI is a leading U.S. producer of gallium nitride-on-silicon carbide ("GaN-on-SiC") power amplifier chips used in defense radar systems, satellite communications ("satcom"), and 5G wireless infrastructure. VPI operates a 45,000-square-foot GaN-on-SiC fabrication facility located at 9200 Innovation Boulevard, Albuquerque, New Mexico, which holds a facility clearance ("FCL") at the SECRET level and is assigned CAGE Code 7VK92 by the Defense Logistics Agency.
VPI employs 486 individuals, of whom 212 (approximately 43.6%) hold active personnel security clearances at the SECRET or TS/SCI level. VPI currently maintains 14 active DoD contracts, with a combined backlog of approximately $193 million. VPI manufactures ITAR-controlled defense articles under Category XI(a)(3) of the United States Munitions List and produces items classified under EAR Export Control Classification Numbers ("ECCNs") 3A001, 3A991, and 3E001. VPI maintains an active registration with the Directorate of Defense Trade Controls ("DDTC") under Registration No. M-24817.
VPI's intellectual property portfolio consists of 47 granted U.S. patents, 12 pending patent applications, and 31 registered trade secrets relating to proprietary GaN epitaxial growth processes, power amplifier circuit architectures, and thermal management technologies.
Key VPI personnel relevant to this negotiation include:
• Dr. Nathan Trevorrow, Chief Executive Officer, who holds a TS/SCI clearance and has served as VPI's CEO since 2016.
• Marissa Sung-Avila, Chief Operating Officer, who holds a SECRET clearance and oversees VPI's manufacturing operations and supply chain.
• Col. (Ret.) Bryce Hendrickson, Vice President of Government Programs and Facility Security Officer ("FSO"), who holds a TS/SCI clearance and has served as VPI's FSO since 2018. Col. Hendrickson previously served 26 years in the U.S. Army signal corps.
• Derek Wainsborough, Chief Financial Officer, who does not hold a security clearance and manages VPI's financial reporting and treasury functions.
D. HSAG Profile
HSAG is an Aktiengesellschaft listed on the Frankfurt Stock Exchange (XETRA: HLC), headquartered in Dresden, Germany. As of June 1, 2023, HSAG had a market capitalization of approximately €14.8 billion. HSAG reported FY2022 revenue of €6.12 billion and EBITDA of €1.37 billion, making it one of the largest semiconductor manufacturers in Europe, with particular strength in power semiconductors, automotive electronics, and industrial sensors.
HSAG's existing U.S. operations are conducted through Halcyon US Inc., a wholly-owned subsidiary based in Austin, Texas. Halcyon US Inc. is a fabless design center employing approximately 320 individuals. Halcyon US Inc. does not perform classified work and does not hold a facility clearance.
HSAG also maintains a subsidiary in China — Halcyon Semiconductor (Shanghai) Co., Ltd. — which recorded revenue of approximately $81.4 million in FY2022 (approximately 1.3% of HSAG's consolidated revenue). The Shanghai subsidiary does not engage in GaN technology development, defense-related activities, or any work involving ITAR- or EAR-controlled items. The existence and activities of the Shanghai subsidiary have been disclosed in detail in the CFIUS filing and supplemental submissions.
E. Procedural History
The SPA was executed on June 10, 2023. The parties filed a voluntary joint notice with CFIUS on July 14, 2023. CFIUS's 45-day initial review period commenced on July 21, 2023, following acceptance of the filing. On September 4, 2023, CFIUS initiated a 45-day investigation, indicating that the Committee had identified national security considerations that could not be resolved during the initial review period. CFIUS communicated its four preliminary national security concerns by letter dated October 20, 2023. The initial draft NSA was circulated to the parties on November 3, 2023. Closing of the acquisition is expressly conditioned on CFIUS clearance pursuant to SPA §7.1(c).
III. Issue 1: Board Composition and Security Board Member Qualifications
A. CFIUS Draft Position
The draft NSA (§§3.1–3.9 and Annex A) requires that VPI's board of directors be reconstituted immediately upon closing to consist of five members: three "Security Board Members" and two HSAG designees. The CFIUS draft imposes the following requirements on this governance structure:
• All three Security Board Members must be U.S. citizens who currently hold, or are eligible to obtain, security clearances at the TS/SCI level.
• One of the three Security Board Members must be designated as an "independent Security Director." The independent Security Director may not be a current or former employee of either HSAG or VPI, may not be a shareholder of either entity, and must possess prior U.S. government national security experience (defined in the draft as at least ten years of service in a U.S. national security agency or in a cleared defense contractor in a security-related role).
• HSAG's two designees may not hold, access, or be briefed on classified information or ITAR-controlled technical data.
• CFIUS retains approval rights over the appointment and replacement of all Security Board Members, including the independent Security Director. The draft provides no corresponding role for HSAG in the selection of the independent Security Director.
• The three Security Board Members collectively constitute the "Government Security Committee" ("GSC"), which is vested with exclusive authority over all matters touching classified programs, ITAR-controlled articles, and any interaction with U.S. government customers. The Security Board Members have veto rights over any board action that implicates these matters.
B. HSAG Preferred Position
HSAG is prepared to accept the fundamental structure of a five-member board with three Security Board Members and two HSAG designees. This structure is consistent with the majority of semiconductor-sector NSA precedents and reflects an appropriate balance between national security oversight and the acquiror's legitimate interest in governing its subsidiary. Specifically, HSAG's preferred position includes the following elements:
1. Clearance Level. HSAG requests that Security Board Members need only hold, or be eligible for, security clearances at the SECRET level, rather than TS/SCI. This request is grounded in the fact that VPI's FCL is at the SECRET level. VPI does not currently hold a TOP SECRET facility clearance, and none of VPI's current classified programs require access to TS/SCI information at the board level. While certain individual VPI employees (including Dr. Trevorrow and Col. Hendrickson) hold TS/SCI clearances for purposes of specific program access, board-level governance of VPI's classified activities does not necessitate TS/SCI access for all three Security Board Members. Requiring TS/SCI for all Security Board Members would unnecessarily narrow the pool of qualified candidates and may delay board constitution.
2. HSAG Designee Access. HSAG's two designees should have full and unrestricted access to all unclassified VPI business information, including financial data, operational metrics, customer pipeline information (for unclassified programs), and commercial (non-ITAR) technical information. This access is essential for HSAG to exercise its ownership rights, fulfill its fiduciary obligations under German corporate law, and comply with its IFRS consolidated financial reporting requirements.
3. Independent Security Director Selection. The independent Security Director should be mutually agreed upon by HSAG and CFIUS, rather than unilaterally selected by CFIUS. HSAG acknowledges CFIUS's legitimate interest in ensuring that the independent Security Director possesses appropriate qualifications and experience. However, HSAG — as the entity bearing the cost of the Security Director's compensation and as VPI's ultimate owner — should have a meaningful role in the selection process, including the right to propose candidates and to object to candidates on reasonable grounds. A mutual-agreement mechanism is consistent with five of the twelve precedent NSAs in our benchmarking analysis.
4. Proposed Candidates. HSAG proposes Col. (Ret.) Bryce Hendrickson (current TS/SCI clearance holder and FSO) and Adrienne Delacroix (current SECRET clearance holder, former Deputy Director of the Defense Technology Security Administration, 22 years of DoD experience) as two of the three Security Board Members. HSAG would work with CFIUS to identify a mutually acceptable independent Security Director as the third member.
5. Financial Reporting Access. HSAG designees should have access to aggregated, unclassified financial information about VPI's classified programs — specifically, revenue, cost of goods sold, gross margin, and operating margin data, presented in aggregate across all classified programs without program-specific detail. This access is necessary for HSAG to prepare consolidated financial statements in compliance with IFRS and to report to its supervisory board and shareholders on the performance of the VPI subsidiary. Denial of this information would create a material gap in HSAG's financial reporting and potentially trigger disclosure issues with German securities regulators (BaFin).
C. Red Lines
The following positions are non-negotiable for HSAG:
• Minimum Board Representation. HSAG must retain at least two designees on VPI's board of directors. HSAG cannot accept a board structure in which it has fewer than two seats. A minority position of one seat or zero seats would effectively strip HSAG of any governance role in a $1.42 billion subsidiary, would be inconsistent with HSAG's rights and obligations as VPI's sole indirect shareholder, and would be unprecedented in our review of comparable NSAs.
• Unclassified Information Access. HSAG designees must have unrestricted access to all unclassified business and financial information of VPI. Any restriction on access to unclassified information would impair HSAG's ability to manage VPI as a subsidiary, to meet its own regulatory reporting obligations, and to realize the commercial value of the acquisition.
• Designee Removal. HSAG will not accept a provision granting CFIUS unilateral authority to remove and replace HSAG's board designees. HSAG acknowledges that CFIUS may have legitimate concerns about specific individuals in extraordinary circumstances (e.g., a designee who is found to pose a counterintelligence risk), and HSAG is prepared to discuss a process for addressing such circumstances. However, a blanket unilateral removal authority is inconsistent with basic corporate governance principles and the acquiror's ownership rights.
D. Fallback Positions
If CFIUS is unwilling to accept HSAG's preferred positions, the following fallback positions are authorized:
• TS/SCI Requirement. HSAG is prepared to accept a TS/SCI clearance requirement for all three Security Board Members if CFIUS insists, provided that CFIUS acknowledges the practical implications. Col. Hendrickson already holds a TS/SCI clearance. Ms. Delacroix currently holds a SECRET clearance but has prior TS/SCI access and could be upgraded through a reinvestigation process. HSAG would need adequate time (estimated 6–12 months) to complete the upgrade, and interim provisions (e.g., a provisional board composition with SECRET-cleared members pending TS/SCI adjudication) should be included in the NSA.
• Independent Security Director Selection. HSAG is prepared to accept CFIUS approval authority (rather than mutual agreement) for the independent Security Director, provided that HSAG retains the right to propose candidates. A provision requiring CFIUS to consider and respond to HSAG-proposed candidates within a defined time frame (e.g., 30 days) would address HSAG's concerns about being excluded from the process.
• Classified Program Financial Information. HSAG is prepared to accept that HSAG designees receive only aggregated financial summaries for classified programs — presenting revenue, margin, and backlog data across all classified programs in a single line item — with no program-specific detail, no contract numbers, no customer agency identification, and no technical description of program scope. This represents the minimum information necessary for consolidated financial reporting.
IV. Issue 2: Technology Access and TCP Scope
A. CFIUS Draft Position
The draft NSA (§§4.1–4.14 and Annex B) requires the establishment of a comprehensive Technology Control Plan ("TCP") governing all transfers of VPI technical data. The CFIUS draft defines "technical data" broadly to encompass all ITAR-controlled data falling under Category XI(a)(3) of the United States Munitions List and all EAR-controlled data classified under ECCNs 3A001, 3A991, and 3E001, as well as all "derivative" technical data — defined as any data derived from, based upon, or incorporating controlled technical data. The TCP provisions include the following key elements:
• The TCP prohibits any transfer of VPI technical data, as broadly defined, to any "non-U.S. person" — a term that encompasses HSAG employees, HSAG affiliates (including Halcyon US Inc. employees who are not U.S. persons), and any third party outside the United States — without prior written authorization from both the GSC and the relevant U.S. government licensing authority.
• The TCP applies to all VPI intellectual property, including the 47 granted U.S. patents, 12 pending patent applications, 31 registered trade secrets, and all derivative technical data generated by VPI.
• The draft prohibits any shared research and development activities between VPI and HSAG (or any HSAG affiliate) that involve "controlled technical data," defined to include any technical data that falls within the scope of the TCP.
• The draft prohibits the co-location of HSAG engineering personnel and VPI engineering personnel on any project involving "controlled items," broadly defined.
• The draft includes an absolute prohibition on the export of any VPI technical data to HSAG's Dresden headquarters, the Shanghai subsidiary, or any other non-U.S. HSAG facility.
B. HSAG Preferred Position
HSAG accepts the fundamental principle that a Technology Control Plan is an appropriate mitigation measure and acknowledges CFIUS's legitimate interest in preventing unauthorized transfers of defense-related and export-controlled technology. However, HSAG has significant concerns about the breadth of the TCP as drafted, which, if accepted without modification, would effectively prevent HSAG from realizing any of the commercial technology synergies that are a central component of the acquisition rationale. HSAG's preferred position is as follows:
1. Narrowed Definition of Controlled Technical Data. The definition of "controlled technical data" should be narrowed to encompass only items that are actually controlled under ITAR Category XI(a)(3) and EAR ECCNs 3A001 and 3E001. The current draft's inclusion of ECCN 3A991 in the controlled-data definition is overbroad, as 3A991 items are subject to only limited export controls (Anti-Terrorism reasons only) and are widely available commercially. More fundamentally, the draft's catch-all reference to "derivative" technical data, without limitation, could sweep in virtually all of VPI's technical knowledge, including purely commercial technologies that have no defense application and are not subject to export controls.
2. Controlled/Uncontrolled Distinction. The TCP should clearly distinguish between controlled and non-controlled VPI technology. VPI's product portfolio includes a significant body of purely commercial 5G wireless infrastructure technology — including power amplifier designs for commercial base stations, thermal management techniques for commercial applications, and GaN epitaxial growth processes optimized for commercial specifications — that is not defense-related, is not listed on the USML, is not classified under restrictive EAR ECCNs, and is commercially available from multiple global sources. This commercial technology should be freely shareable with HSAG for the purpose of realizing commercial synergies. The inability to share this technology would eliminate a substantial portion of the projected synergy value underpinning the $1.42 billion purchase price.
3. Joint R&D for Commercial Technology. The TCP should permit joint research and development activities between VPI and Halcyon US Inc. (the Austin, Texas design center) on uncontrolled commercial GaN technology, subject to appropriate screening procedures to ensure that controlled technical data is not inadvertently included. The Austin facility does not hold a facility clearance and does not perform classified work; joint R&D at that facility on commercial technology presents minimal national security risk.
4. Government-Licensed Technology. Of VPI's 47 granted patents, 23 were developed under government-funded contracts and are subject to march-in rights under 35 U.S.C. §203 and the rights provisions of DFARS 252.227-7038. The U.S. government already holds license rights to the technical data underlying these patents. TCP restrictions should focus on genuinely proprietary VPI technology that is not already accessible to the U.S. government through existing license rights. The application of TCP restrictions to technology that the government itself can use and disclose is duplicative and suggests an overbroad scope.
5. Existing Export Licenses. VPI currently holds valid DSP-5 licenses for deliveries of certain defense articles to the United Kingdom and Australia, both of which are close U.S. allies and members of the Five Eyes intelligence-sharing community. The TCP should not impede VPI's ability to fulfill obligations under these existing export licenses. VPI's ability to perform on its foreign military sales and direct commercial sales to allied nations is an important component of VPI's revenue base and contributes to the government contract backlog that CFIUS itself has identified as a national security interest.
C. Red Lines
The following positions are non-negotiable:
• Overbroad TCP. HSAG cannot accept a TCP that treats all VPI technology as controlled — including purely commercial, non-defense, non-export-controlled technology. Such a TCP would eliminate virtually all commercial synergy value from the $1.42 billion acquisition and would render the transaction uneconomic. HSAG's supervisory board approved this acquisition on the basis of a business case that projected approximately €180 million in cumulative commercial technology synergies over the first five years post-closing. A TCP that prevents any sharing of commercial technology would reduce those synergies to zero.
• Commercial Technology Sharing. HSAG must retain the ability to share non-ITAR, non-EAR-controlled commercial technology with its global operations, including its Dresden headquarters and the Austin design center. HSAG acknowledges that sharing with the Shanghai subsidiary raises distinct concerns (addressed in the fallback positions below) and is prepared to accept restrictions specific to China.
D. Fallback Positions
If CFIUS is unwilling to accept HSAG's preferred position on TCP scope, the following fallback positions are authorized:
• Technology Release Determination Mechanism. HSAG is prepared to accept a broad TCP initially — encompassing all VPI technical data — provided that the NSA includes a defined mechanism for HSAG to request "technology release determinations" from the GSC on a case-by-case basis for specific items of non-controlled technology. Under this mechanism, HSAG would submit a written request identifying the specific technology, its export control classification (or lack thereof), and the intended use and recipient. The GSC would have a defined period (HSAG proposes 30 business days) to review the request and issue a determination. If the GSC determines that the technology is not controlled under ITAR or restricted EAR ECCNs, the technology would be released from TCP restrictions. This approach gives CFIUS the initial broad protection it seeks while providing HSAG a pathway to unlock commercial synergy value over time.
• China-Specific Carve-Out. HSAG is prepared to accept a prohibition on sharing any VPI technology — including non-controlled commercial technology — with Halcyon Semiconductor (Shanghai) Co., Ltd. specifically. This represents a significant concession, as it would prevent HSAG from leveraging any VPI technology in its Chinese operations, even for purely commercial purposes. However, HSAG recognizes that the presence of the Shanghai subsidiary is likely a significant concern for CFIUS, particularly for DoD and DOE, and that a blanket prohibition on technology sharing with the Chinese entity may be necessary to resolve this concern definitively.
• Implementation Period. HSAG is prepared to accept a six-month implementation period for the TCP following closing, during which interim restrictions would apply. The interim restrictions would prohibit any transfer of ITAR-controlled or classified technical data to non-U.S. persons but would permit continued operation of existing commercial technology-sharing arrangements pending full TCP implementation. This phased approach acknowledges the operational complexity of establishing a comprehensive TCP and the need for careful classification of VPI's technology portfolio.
• Reclassification Review. HSAG proposes that the six items identified by Christy Bauer (VPI's export control officer) in her October 2, 2023 memorandum as requiring reclassification review under the EAR be resolved before the TCP's scope is finalized. Three of these items may not warrant classification under ECCN 3A001, and their reclassification to EAR99 would remove them from TCP coverage. Including these items in the TCP without first resolving their classification status would result in unnecessary restrictions.
V. Issue 3: Monitor Scope and Independence
A. CFIUS Draft Position
The draft NSA (§§6.1–6.15 and Annex D) establishes a comprehensive third-party compliance monitoring regime with the following principal elements:
• A third-party compliance monitor (the "Monitor") is to be appointed, with broad access to all VPI facilities, all HSAG U.S. facilities, all personnel of both entities, all records (including electronic records, correspondence, and communications), and all systems.
• The Monitor reports directly to the CFIUS monitoring agencies — specifically, the Defense Counterintelligence and Security Agency ("DCSA"), the Department of the Treasury, the Department of Defense, and the Department of Energy — and does not report to, or take direction from, HSAG or VPI.
• The Monitor has authority to conduct unannounced inspections of VPI and HSAG U.S. facilities at any time during normal business hours, without prior notice to the parties.
• The Monitor has authority to investigate any "potential violation" of the NSA and to compel the production of documents, records, and information from VPI, HSAG, and their respective employees and agents.
• The Monitor's scope of activities includes: (i) annual comprehensive compliance audits covering all NSA obligations; (ii) quarterly spot checks on specific compliance areas; (iii) ad hoc investigations triggered by reported incidents, tips, or other indicia of non-compliance; and (iv) ongoing review of all HSAG-VPI communications, including emails, shared documents, and meeting records.
• The Monitor is appointed for an indefinite term, coterminous with the NSA itself (which, under the CFIUS draft, has no expiration date — see Issue 8).
• DCSA is designated as the primary monitoring agency responsible for day-to-day oversight of VPI's compliance.
B. HSAG Preferred Position
HSAG accepts the concept of a third-party compliance monitor as an appropriate component of the mitigation framework. Third-party monitoring is standard in semiconductor-sector NSAs, appearing in eleven of the twelve precedent agreements in our benchmarking analysis. However, the scope and modalities of the monitoring regime must be defined with sufficient precision to protect legitimate business interests, prevent undue operational disruption, and ensure that monitoring is focused on NSA-relevant compliance rather than serving as an open-ended investigative mandate. HSAG's preferred position includes:
1. Scope of Access. The Monitor's access should be limited to VPI facilities and VPI personnel, and to those HSAG U.S. personnel who interact with VPI in connection with matters covered by the NSA (e.g., HSAG designees on VPI's board, HSAG personnel involved in financial reporting or IT administration). The Monitor should not have access to HSAG's German headquarters, non-U.S. operations, or HSAG facilities and personnel that have no connection to VPI. The draft's grant of access to "all HSAG U.S. facilities" is overbroad, as HSAG's Austin design center (Halcyon US Inc.) conducts purely commercial semiconductor design work unrelated to VPI's defense activities.
2. Audit Frequency. HSAG proposes that the Monitor conduct one annual comprehensive compliance audit and one mid-year spot check per year, rather than the quarterly spot checks contemplated by the CFIUS draft. A quarterly cycle imposes significant operational burden on VPI personnel, who must devote substantial time to preparing for and participating in Monitor visits, and the incremental compliance value of quarterly (versus semi-annual) reviews is marginal in a well-designed monitoring program.
3. Inspection Notice. HSAG requests that all Monitor visits be conducted with at least 48 hours' advance notice, except in emergency circumstances where the CFIUS monitoring agencies have identified a specific, credible threat or indication of a violation. Unannounced inspections are disruptive to VPI's manufacturing operations — the Albuquerque fab operates on a continuous production schedule for defense-grade wafers, and unplanned facility access events can affect cleanroom integrity, production yields, and delivery schedules on active DoD contracts. A 48-hour notice requirement still provides the Monitor with ample opportunity to conduct meaningful compliance reviews while minimizing operational disruption.
4. Report Sharing. Monitor reports should be simultaneously shared with HSAG (through Calderwood & Harkness as HSAG's U.S. counsel) to allow HSAG to review the Monitor's findings and submit a written response or rebuttal before the report is finalized and submitted to CFIUS agencies. This is a matter of fundamental fairness: the monitored parties should have the opportunity to correct factual errors, provide context for the Monitor's observations, and present evidence of remedial actions taken, before a report is presented to CFIUS as a final product. Simultaneous sharing is provided for in four of the twelve precedent NSAs.
5. Monitor Selection. HSAG proposes Whitmore Compliance Group LLC ("WCG") as the third-party Monitor. WCG is led by Gerald Whitmore, a former supervisory special agent of the FBI's Counterintelligence Division, who holds a TS/SCI clearance and has extensive experience serving as a compliance monitor in CFIUS mitigation agreements, including three semiconductor-sector NSAs executed between 2020 and 2023. WCG is located at 1300 Crystal Drive, Suite 710, Arlington, Virginia 22202. WCG has been vetted by Calderwood & Harkness and is experienced in the specific compliance issues arising under semiconductor-sector NSAs, including TCP implementation, cybersecurity monitoring, and classified program oversight. Early identification and vetting of a proposed Monitor accelerates the NSA implementation process and reduces the risk of post-closing delays.
6. Monitor Term. The Monitor's engagement should align with the term of the NSA. The draft's reference to an "indefinite" Monitor engagement is a function of the indefinite NSA term and should be addressed as part of the term/sunset discussion (Issue 8). In any event, the Monitor engagement agreement should include provisions for periodic performance reviews and, if warranted, replacement of the Monitor by mutual agreement of the parties and CFIUS.
C. Red Lines
The following positions are non-negotiable:
• Global Corporate Systems. The Monitor must not have access to HSAG's global corporate systems, trade secrets, or proprietary technology unrelated to VPI. The Monitor's mandate is to verify compliance with the NSA's terms as they relate to VPI and HSAG's interactions with VPI. Extending the Monitor's access to HSAG's unrelated global operations would expose HSAG's proprietary commercial information to potential disclosure, would raise data privacy issues under EU law (including the General Data Protection Regulation), and would exceed the scope of CFIUS's statutory authority.
• Document Production Standard. The Monitor's authority to "compel" production of documents must be subject to a reasonableness limitation. The Monitor should be authorized to request and obtain documents that are relevant to NSA compliance — not documents unrelated to VPI's defense activities or HSAG's obligations under the NSA. The draft's unlimited compulsion authority could be used to demand production of HSAG's global corporate records, strategic plans, and proprietary business information, which is inappropriate.
• Report Access. HSAG must receive copies of all Monitor reports and have an opportunity to submit a written response or rebuttal before reports are finalized. HSAG cannot accept a monitoring regime in which reports are submitted to CFIUS agencies without the monitored parties' knowledge or input. At minimum, HSAG must receive each report contemporaneously with its submission to CFIUS.
D. Fallback Positions
• Quarterly Spot Checks. If CFIUS insists on quarterly spot checks (rather than semi-annual), HSAG is prepared to accept this frequency provided that each quarterly spot check is limited to a focused compliance area (e.g., Q1: TCP compliance; Q2: cybersecurity; Q3: facility access logs and personnel clearance status; Q4: financial reporting and board governance) rather than a comprehensive review. Focused quarterly reviews would reduce the operational burden while maintaining the cadence CFIUS seeks.
• Report Sharing Timing. If CFIUS is unwilling to accept simultaneous report sharing, HSAG is prepared to accept a provision under which Monitor reports are submitted directly to CFIUS agencies, but HSAG receives a copy within five business days of submission, together with the right to submit a written response within ten business days of receipt. CFIUS agencies would be obligated to consider HSAG's response before taking any action based on the Monitor's findings.
• Unannounced Inspections. If CFIUS insists on retaining unannounced inspection authority, HSAG is prepared to accept unannounced inspections limited to the Albuquerque classified facility only (not VPI's Colorado Springs headquarters or HSAG's Austin facility), and subject to same-day telephonic notice to HSAG's U.S. counsel (Calderwood & Harkness LLP, Attn: Margaret Ashworth). This compromise permits the government to maintain the element of surprise for classified-facility inspections while ensuring that HSAG's counsel is promptly informed.
VI. Issue 4: Cost Allocation for Monitor and Compliance
A. CFIUS Draft Position
The draft NSA (§§6.16–6.19) addresses cost allocation for monitoring and compliance as follows:
• All costs associated with the third-party Monitor — including fees, expenses, travel, and any other costs — are to be borne exclusively by HSAG (through VPI).
• The draft does not specify a fee amount or a fee structure; instead, it contemplates that the Monitor's fees will be set forth in a separate engagement agreement between the Monitor and VPI/HSAG, subject to CFIUS approval.
• All internal VPI compliance costs — including personnel costs for compliance officers and support staff, IT infrastructure costs for compliance systems, and training costs — are to be borne by VPI (and, therefore, indirectly by HSAG as VPI's post-closing owner).
• The draft does not expressly state that HSAG is responsible for the costs of CFIUS's own monitoring and enforcement activities (i.e., the internal costs incurred by DCSA, Treasury, DoD, and DOE in overseeing VPI's compliance). However, the absence of any limitation on HSAG's cost obligations, combined with the draft's broad language regarding "all costs associated with compliance with this Agreement," could be construed to include such costs.
B. HSAG Preferred Position
HSAG accepts that the acquiror bears the costs of the third-party Monitor, which is standard practice in CFIUS mitigation agreements. However, these costs must be defined with sufficient clarity and predictability to allow HSAG to budget and plan for them, and must be consistent with the costs borne by acquirors in comparable transactions. HSAG's preferred position includes:
1. Fixed Annual Fee. HSAG proposes to negotiate a fixed annual fee with the selected Monitor (WCG), targeting an annual fee in the range of $1.0 million to $1.2 million. This range is consistent with the precedent analysis of comparable semiconductor-sector NSAs, in which annual monitor fees ranged from $800,000 to $1.8 million, with a median of $1.1 million.
2. Payment Structure. HSAG proposes a quarterly payment structure, with payments of $250,000 to $300,000 per quarter, to facilitate cash flow management at the VPI subsidiary level and to align Monitor payments with VPI's quarterly financial reporting cycle.
3. Escalation. Annual fee adjustments should be limited to a Consumer Price Index ("CPI") adjustment, not subject to uncapped escalation at the Monitor's discretion. The engagement agreement should specify the CPI index to be used (HSAG proposes the U.S. Bureau of Labor Statistics CPI-U, All Urban Consumers) and should cap annual increases at the CPI change, with no minimum annual increase.
4. Government Costs. HSAG's cost obligations should be limited to the third-party Monitor's fees and expenses and VPI's internal compliance costs. HSAG should not bear the costs of CFIUS's own internal agency monitoring and enforcement activities, which are ordinary government operational costs funded through congressional appropriations. There is no statutory authority for CFIUS to charge the costs of its own personnel and operations to the monitored party.
5. Scope Reduction. The Monitor fee should be subject to renegotiation if the scope of monitoring is reduced or NSA obligations are narrowed over time (e.g., as a result of a periodic review under the term/sunset provisions discussed in Issue 8). A fixed fee negotiated at the outset of the NSA should not remain at the same level if the Monitor's workload is subsequently reduced due to demonstrated compliance and relaxation of monitoring intensity.
6. Tax Treatment. Internal compliance costs at VPI should be treated as ordinary and necessary business expenses and should be deductible for U.S. federal income tax purposes. While this is primarily a matter of VPI's tax position rather than an NSA drafting issue, the NSA should not contain any language that would characterize compliance costs as "penalties" or "fines" (which would be non-deductible under IRC §162(f)) rather than as costs of doing business.
C. Red Lines
• Annual Fee Cap. Total Monitor fees must not exceed $1.5 million per year, inclusive of CPI adjustments during the initial years of the NSA. An annual fee substantially in excess of this amount would be disproportionate to the scope of the monitoring program and would exceed the range observed in comparable precedent transactions. If CFIUS or the Monitor proposes fees above this threshold, HSAG would need to re-evaluate the overall economics of the transaction.
• Government Agency Costs. HSAG will not accept responsibility for the costs of CFIUS's internal government monitoring activities. There is no statutory basis for such a charge, and no precedent for it in the twelve semiconductor-sector NSAs reviewed.
D. Fallback Positions
• Fee Level. If CFIUS or the Monitor insists on a fee above $1.0 million, HSAG is prepared to accept $1.2 million per year ($300,000 per quarter) with CPI adjustment. This fee level aligns with the median of precedent benchmarks and reflects the moderate complexity of VPI's compliance profile (one cleared facility, 14 active DoD contracts, and a workforce with approximately 212 cleared individuals).
• Travel and Incidental Expenses. HSAG is prepared to accept that it bears the Monitor's travel and incidental expenses (airfare, lodging, meals, and local transportation for on-site visits) in addition to the fixed fee, provided that such expenses are subject to a reasonable annual cap. HSAG proposes a cap of $100,000 per year for travel and incidental expenses, with expenses above that amount requiring advance approval by HSAG.
VII. Issue 5: Personnel Retention Requirements
A. CFIUS Draft Position
The draft NSA (§§5.1–5.8) includes key personnel retention requirements with the following principal elements:
• Certain VPI personnel designated as "key personnel" must remain employed at VPI for a minimum period following the closing of the acquisition.
• "Key personnel" are defined as: (i) Dr. Nathan Trevorrow, Chief Executive Officer; (ii) Marissa Sung-Avila, Chief Operating Officer; and (iii) Col. (Ret.) Bryce Hendrickson, Vice President of Government Programs and Facility Security Officer.
• The minimum retention period is 36 months following the closing date.
• Any replacement of a key personnel member — whether due to termination, resignation, retirement, disability, or death — must be approved by both the GSC and DCSA before the replacement may assume the key personnel role.
• Termination of any key personnel member by HSAG or VPI (whether for cause or without cause) requires 60 days' advance written notice to both CFIUS and DCSA before the termination takes effect.
B. HSAG Preferred Position
HSAG accepts the concept of key personnel retention provisions as a reasonable element of CFIUS mitigation. The continuity of experienced leadership at VPI — particularly individuals who hold security clearances and have established relationships with DoD program offices — is important for maintaining VPI's government contract performance and its facility clearance. HSAG's preferred position is as follows:
1. Retention Period. HSAG proposes that the mandatory retention period be set at 18 months, rather than 36 months. An 18-month period provides sufficient time for HSAG to integrate VPI's operations, establish relationships with VPI's government customers, and develop a pipeline of successor candidates, while avoiding the operational and legal complications associated with an excessively long mandatory retention period.
2. Key Personnel Identification. HSAG accepts the identification of Dr. Trevorrow, Ms. Sung-Avila, and Col. Hendrickson as the three key personnel. These individuals were identified in VPI's CFIUS submission as holding the most critical roles for purposes of classified program management, facility security, and government customer relationships.
3. Voluntary Departures. Voluntary departures by key personnel (i.e., resignations initiated by the individual) should not constitute a violation of the NSA, provided that HSAG and VPI made good-faith, commercially reasonable efforts to retain the individual. The NSA should not impose strict liability for an event that is not within HSAG's control — specifically, an individual's decision to leave. Employment law principles, including the at-will employment doctrine, preclude an employer from compelling an individual to remain employed, and the NSA should not create an obligation that HSAG cannot lawfully fulfill.
4. Replacement Approval. The replacement approval process should be streamlined to require GSC approval only, with notification to DCSA. The dual-approval requirement (GSC plus DCSA) creates an unnecessary procedural burden that could delay the installation of qualified replacement personnel, which in turn could disrupt VPI's classified programs and government contract performance — the very outcome CFIUS is seeking to prevent.
5. Retirement and Disability. If a key personnel member retires or becomes disabled, the event should trigger a 90-day cure period during which HSAG and VPI must identify and obtain approval for a qualified replacement. Retirement or disability should not be treated as an immediate NSA violation, as these are foreseeable life events for which a reasonable remediation period is appropriate.
C. Red Lines
• Maximum Retention Period. The personnel retention period must not exceed 24 months. A 36-month mandatory retention period is commercially unreasonable, creates complications under employment law (particularly Colorado's non-compete and restrictive covenant statutes, which apply to VPI's Colorado Springs-based employees), and is at the outer edge of the precedent range observed in comparable NSAs. The median retention period in our benchmarking analysis is 24 months. HSAG's supervisory board has expressed concern about committing to retention obligations that may constrain VPI's ability to make management changes in response to performance issues.
• Commercially Reasonable Efforts Standard. HSAG cannot guarantee that any individual will choose to remain employed at VPI. The NSA must include a "commercially reasonable efforts" standard with a defined cure period for voluntary departures. Strict liability for an employee's decision to resign would be legally unenforceable and would expose HSAG to penalties for events beyond its control.
• FSO Priority. Col. Hendrickson's role as FSO is the most critical from CFIUS's perspective, as the FSO is the individual responsible for day-to-day oversight of VPI's compliance with the National Industrial Security Program Operating Manual ("NISPOM") and the facility clearance requirements. HSAG recognizes that CFIUS may seek enhanced protections for this role specifically, and HSAG is willing to negotiate enhanced provisions applicable to the FSO role (as distinct from the CEO and COO roles) to address CFIUS's concerns.
D. Fallback Positions
• 24-Month Compromise. HSAG is prepared to accept a 24-month retention period as a compromise between HSAG's preferred 18-month period and CFIUS's 36-month position. This aligns with the median of precedent benchmarks and provides adequate time for succession planning.
• Differentiated Approval. HSAG is prepared to accept dual approval (GSC plus DCSA) for the replacement of Col. Hendrickson specifically, given his FSO role and its direct relevance to facility security and DCSA oversight. For replacements of Dr. Trevorrow and Ms. Sung-Avila, HSAG proposes GSC-only approval with notification to DCSA.
• Notice Periods. HSAG is prepared to accept the 60-day advance notice requirement for terminations initiated by HSAG or VPI (i.e., employer-initiated separations). For voluntary departures (i.e., employee-initiated resignations), HSAG requests a reduced notice period of 30 days, as HSAG's ability to provide advance notice of a resignation is inherently limited by the timing of the employee's decision.
• Enhanced Retention Packages. As a practical mitigation measure separate from the NSA's legal requirements, HSAG proposes to implement enhanced retention packages ("golden handcuffs") for each of the three key personnel, to be structured in consultation with HSAG's human resources team and VPI's current employment counsel. These packages would include retention bonuses, accelerated equity vesting (or cash-equivalent awards), and enhanced severance provisions designed to incentivize each individual to remain at VPI through the mandatory retention period. The existence and terms of these packages would be disclosed to CFIUS as evidence of HSAG's good-faith commitment to personnel continuity, but the specific terms of the packages would not be incorporated into the NSA itself.
VIII. Issue 6: Cybersecurity Standards (NIST SP 800-171 vs. CMMC)
A. CFIUS Draft Position
The draft NSA (§§8.1–8.12 and Annex E) imposes comprehensive cybersecurity requirements on VPI, including:
• VPI must maintain compliance with NIST Special Publication 800-171, Revision 2, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations," for all covered defense information ("CDI") processed, stored, or transmitted by VPI systems.
• VPI must achieve Cybersecurity Maturity Model Certification ("CMMC") Level 2 certification within 12 months of the closing date.
• VPI must undergo annual third-party penetration testing by a firm approved by the Monitor, with results reported to the Monitor and DCSA.
• VPI must report any cybersecurity incident to DCSA within 24 hours of detection.
• The draft requires complete physical and logical separation of all VPI IT systems from HSAG's global network. Specifically, the draft prohibits any shared cloud infrastructure, shared email systems, shared virtual private network ("VPN") connections, shared data centers, or any other shared IT resource between VPI and HSAG or any HSAG affiliate.
• VPI must maintain a separate, U.S.-based IT team with no reporting relationship to HSAG IT leadership.
B. HSAG Preferred Position
HSAG acknowledges the importance of robust cybersecurity for VPI's classified and controlled defense information and is committed to maintaining and enhancing VPI's cybersecurity posture. VPI has invested substantially in its cybersecurity infrastructure and is already substantially compliant with NIST SP 800-171, as documented in VPI's System Security Plan and Plan of Actions and Milestones, both of which were provided to CFIUS in the supplemental submission of September 22, 2023. HSAG's preferred position is as follows:
1. NIST SP 800-171 Compliance. HSAG accepts the requirement to maintain VPI's compliance with NIST SP 800-171, Revision 2. VPI is already substantially compliant, with only seven open items on its current Plan of Actions and Milestones, all of which are scheduled for remediation by Q1 2024. Acceptance of this requirement is straightforward.
2. CMMC Level 2 Timeline. HSAG proposes that the CMMC Level 2 certification timeline be aligned with DoD's own CMMC program rollout schedule. The CMMC program has been subject to repeated delays; the final rule implementing CMMC 2.0 has not yet been published, the CMMC Accreditation Body ("The Cyber AB") is still in the process of certifying CMMC Third-Party Assessment Organizations ("C3PAOs"), and DoD has not yet begun including CMMC Level 2 requirements in new contract solicitations. Requiring VPI to achieve CMMC Level 2 certification within 12 months of closing — when the program infrastructure for third-party assessment may not yet be operational — is impractical. HSAG proposes a timeline of 24 months post-closing or upon the effective date of the CMMC final rule, whichever is later. This ensures that VPI pursues certification diligently while avoiding the imposition of a hard deadline tied to a standard that is not yet fully defined or operational.
3. Incident Reporting. HSAG proposes a 72-hour incident reporting window, rather than the 24-hour window in the CFIUS draft. A 72-hour reporting window is consistent with the existing DFARS 252.204-7012 clause ("Safeguarding Covered Defense Information and Cyber Incident Reporting"), which requires reporting of cyber incidents to the DoD Cyber Crime Center (DC3) within 72 hours of discovery. The 72-hour period allows VPI's cybersecurity team to detect the incident, conduct initial triage to confirm that a reportable event has occurred (as opposed to a false positive or a non-security event), assess the scope and severity of the incident, and prepare a meaningful initial report. A 24-hour window would likely result in premature, incomplete, and potentially misleading reports that create unnecessary alarm and consume DCSA resources.
4. IT Separation — Classified vs. Unclassified. HSAG accepts the requirement for complete physical and logical separation of VPI's classified IT systems and any systems processing ITAR- or EAR-controlled technical data from HSAG's global network. However, HSAG proposes that VPI be permitted to share unclassified enterprise resource planning ("ERP"), human resources ("HR"), and financial reporting systems with HSAG for the purpose of processing unclassified administrative data. This is essential for HSAG to meet its IFRS consolidated financial reporting obligations, to manage VPI's payroll and benefits through HSAG's global HR platform, and to integrate VPI into HSAG's enterprise-wide planning and budgeting processes. Shared administrative systems would process only unclassified data and would be architected with appropriate access controls and network segmentation.
5. IT Reporting Structure. HSAG proposes that VPI IT personnel be divided into two categories: (i) those with access to classified systems, who would report exclusively to the GSC and the FSO, and (ii) those responsible for unclassified administrative systems, who would maintain a primary reporting line to a VPI IT director with a dotted-line reporting relationship to HSAG IT for administrative and budgetary coordination purposes. This dual-reporting structure preserves the security of classified IT operations while enabling the operational efficiencies necessary for an effective parent-subsidiary relationship.
6. Penetration Testing. HSAG accepts the requirement for annual third-party penetration testing. However, HSAG proposes that VPI (through its IT security team and the GSC) select the penetration testing firm, subject to Monitor approval. The current draft's silence on the selection process implies that the Monitor selects the firm unilaterally, which could result in the selection of a firm unfamiliar with VPI's systems architecture or one that charges disproportionate fees. VPI's participation in the selection process ensures that the testing is conducted by a qualified firm with relevant experience.
C. Red Lines
• Incident Reporting Window. A 24-hour incident reporting window is operationally impractical and inconsistent with existing DoD reporting requirements under DFARS 252.204-7012. HSAG's minimum acceptable reporting window is 48 hours, with a strong preference for 72 hours. Detection, triage, and initial assessment of cybersecurity incidents — particularly sophisticated intrusions that may not trigger obvious indicators — require time. Premature reporting would generate noise and reduce the quality of reporting, ultimately undermining the effectiveness of the incident response framework.
• Unclassified Administrative Systems. Complete IT separation, including unclassified ERP and financial reporting systems, would cost an estimated $8 million to $12 million to implement (based on VPI's current IT architecture assessment prepared by Granite Harbor Advisors in August 2023) and would prevent HSAG from integrating VPI into its consolidated financial reporting and enterprise management systems. HSAG cannot accept complete separation for unclassified administrative systems. This is not merely a matter of convenience or cost savings; it is a fundamental requirement for HSAG's ability to manage VPI as a subsidiary and to comply with its own regulatory obligations.
• CMMC Timeline. HSAG cannot accept a hard deadline of 12 months for CMMC Level 2 certification when the CMMC program itself has not yet been fully implemented by DoD. Imposing a rigid timeline that requires compliance with a standard not yet operational creates the risk that VPI will be found in violation of the NSA through no fault of its own — because the assessment infrastructure does not yet exist to certify VPI's compliance. HSAG is committed to achieving CMMC Level 2 certification on a timeline aligned with the program's availability and will make commercially reasonable efforts to complete certification as expeditiously as practicable.
D. Fallback Positions
• 48-Hour Incident Reporting. As a compromise between the CFIUS draft's 24-hour requirement and HSAG's preferred 72-hour window, HSAG is prepared to accept a 48-hour incident reporting window. This provides sufficient time for initial triage and assessment while addressing CFIUS's interest in prompt notification.
• CMMC Timeline Compromise. HSAG proposes the following compromise

MEMORANDUM

PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT

Record

Parties

Dates

Amounts