PRIVILEGED AND CONFIDENTIAL ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP
599 Lexington Avenue New York, New York 10022
1601 K Street NW Washington, DC 20006
MEMORANDUM
Right-click to update Table of Contents
I. Executive Summary
The purpose of this memorandum is to assess whether Solara Digital Infrastructure Fund VI LP ("Fund VI"), acting through Stratos Merger Sub Inc. ("Merger Sub"), should file a voluntary notice with the Committee on Foreign Investment in the United States ("CFIUS") in connection with the proposed acquisition of Cloudium Technologies plc ("Cloudium" or the "Target") via a reverse triangular merger (the "Transaction"). This memorandum was prepared at the request of Harrison Wexford and Tiffany Rosenthal, in coordination with the broader deal team, to inform the regulatory clearance strategy for the Transaction.
Our conclusion is that a voluntary CFIUS notice is not recommended. Based on the analysis set forth in this memorandum, Cloudium does not constitute a "TID U.S. business" within the meaning of the Foreign Investment Risk Review Modernization Act of 2018 ("FIRRMA") and the implementing regulations promulgated thereunder at 31 C.F.R. Parts 800 and 802. Cloudium does not hold or operate "covered real estate" as defined in 31 C.F.R. Part 802. The Transaction does not trigger a mandatory CFIUS declaration under any applicable provision of the regulations, and the overall risk profile of the Transaction does not, in our judgment, warrant a voluntary filing.
As a threshold matter, this conclusion is substantially driven by the fact that the acquirer in this Transaction is not a "foreign person" as that term is defined in the CFIUS regulations. Solara Digital Infrastructure LP is a Delaware limited partnership. Its general partner, Solara Digital GP LLC, is a Delaware limited liability company. The investing fund, Fund VI, is likewise a Delaware limited partnership, and its general partner, Solara Fund VI GP LLC, is also a Delaware limited liability company. The managing partners of Solara — Marcus Elliston (Founder & Managing Partner) and Priya Narasimhan (Co-Managing Partner & Chief Investment Officer) — are both United States persons. The buyer side of the Transaction therefore does not present the foreign-ownership, foreign-control, or foreign-influence concerns that would typically trigger CFIUS jurisdiction. We have nonetheless conducted a comprehensive belt-and-suspenders analysis of the Target's status as a potential TID U.S. business to ensure that this assessment is complete and to guard against the possibility that the acquirer's status could change between now and closing or that CFIUS might exercise its residual non-notified transaction authority in unforeseen circumstances.
This memorandum addresses each element of the CFIUS jurisdictional analysis in turn, including the identity and organizational structure of the acquirer, the Target's business operations and government-contract relationships, the three prongs of TID U.S. business status (critical technologies, critical infrastructure, and sensitive personal data), covered real estate, and the policy and practical considerations bearing on whether a voluntary filing is nonetheless advisable. Our recommendation is that it is not.
II. Background: Transaction Overview
A. Parties and Structure
Buyer. The buyer in the Transaction is Solara Digital Infrastructure Fund VI LP ("Fund VI"), a Delaware limited partnership with a 2022 vintage and approximately $12.4 billion in total committed capital. Fund VI is part of the broader Solara Digital Infrastructure LP ("Solara") platform, which manages approximately $38 billion in assets under management across six flagship funds and related co-investment vehicles. Solara is headquartered at 1200 Market Street, Suite 3400, Wilmington, Delaware 19801. Fund VI's general partner is Solara Fund VI GP LLC, a Delaware limited liability company. The managing partners of Solara, who exercise investment and voting authority over Fund VI through Solara Fund VI GP LLC, are Marcus Elliston (Founder & Managing Partner) and Priya Narasimhan (Co-Managing Partner & Chief Investment Officer), both of whom are United States persons.
Target. The target is Cloudium Technologies plc ("Cloudium"), a public limited company incorporated under the laws of England and Wales (Company No. 09734521). Cloudium's registered office is located at 45 Broadwick Street, London W1F 0DB, United Kingdom. The company's U.S. headquarters is located at 600 Townsend Street, Suite 800, San Francisco, California 94103. Cloudium's shares are listed on the Nasdaq Global Select Market under the ticker symbol "CLDM." As of the date of this memorandum, Cloudium has approximately 184,200,000 shares of common stock outstanding.
Merger Sub. Stratos Merger Sub Inc. ("Merger Sub") is a Delaware corporation formed solely to effectuate the reverse triangular merger contemplated by the Transaction. Merger Sub was incorporated on January 8, 2024 (Delaware File No. 7923841). Its sole stockholder is Fund VI. Merger Sub has no operations, assets, or liabilities other than those incident to its formation and the execution of the Transaction.
Transaction Structure. The Transaction is structured as a reverse triangular merger under the Delaware General Corporation Law (the "DGCL"). In the merger, Merger Sub will merge with and into Cloudium, with Cloudium surviving as a wholly owned subsidiary of Fund VI. Each outstanding share of Cloudium common stock (other than shares held by stockholders electing rollover treatment, as discussed below, and shares held by Cloudium or any of its wholly owned subsidiaries) will be converted into the right to receive approximately $36.92 per share in cash, without interest and subject to applicable withholding taxes. The aggregate deal value of the Transaction is approximately $6,800,000,000 (inclusive of net debt and other adjustments as specified in the draft Merger Agreement, which is being prepared by this firm and Ridgeway Phelps & Sato LLP, counsel to the Target).
Co-Investment Vehicle. Solara Digital Co-Invest VI-A LP, a Delaware limited partnership, will co-invest approximately $425,000,000 alongside Fund VI in connection with the Transaction. This co-investment vehicle is controlled by Solara Fund VI GP LLC and is included in the buyer-side organizational chart for completeness.
B. Cloudium's Business Description
Cloudium is a provider of cloud-native enterprise resource planning ("ERP"), customer-relationship management ("CRM"), and business-intelligence ("BI") software-as-a-service ("SaaS") solutions. The company serves mid-market and enterprise customers across a range of industries, including retail, manufacturing, healthcare administration, financial services, and technology. Cloudium's core product suite includes: (i) Cloudium ERP, a modular enterprise resource planning platform; (ii) Cloudium CRM, a customer-relationship management and sales automation platform; and (iii) Cloudium Insights, a business-intelligence and analytics platform that integrates with the ERP and CRM modules as well as third-party data sources.
For the last twelve months ended September 30, 2023 (Cloudium's fiscal year end), the company reported revenue of approximately $1,620,000,000 and EBITDA of approximately $405,000,000, representing an EBITDA margin of approximately 25.0%. As of December 31, 2023, Cloudium's annualized recurring revenue ("ARR") was approximately $1,740,000,000, reflecting continued growth in its subscription-based SaaS revenue model. The company employs approximately 6,800 individuals globally, distributed across the United States, the United Kingdom, India, and Germany.
Cloudium's technology stack is built on a multi-tenant cloud architecture hosted by third-party infrastructure-as-a-service providers (principally Ridgeway Industries and Crestline Systems). Cloudium does not own or operate its own data center facilities. The company's software development activities are conducted primarily in San Francisco, California; London, United Kingdom; and Bangalore, India.
C. Cloudium's Global Subsidiaries
Cloudium operates through the following principal subsidiaries:
• Cloudium Technologies UK Ltd. (Company No. 11287456), with its registered office at 45 Broadwick Street, London W1F 0DB, United Kingdom. This subsidiary employs approximately 1,200 individuals and reported revenue of approximately £312,000,000 (approximately $390,000,000 at a conversion rate of $1.25 per pound sterling) for the fiscal year ended September 30, 2023. Cloudium Technologies UK Ltd. houses a portion of the company's software engineering, product management, and European sales and customer-success teams.
• Cloudium Technologies India Pvt. Ltd., incorporated in Bangalore, Karnataka, India. This subsidiary employs approximately 2,400 individuals, primarily in research and development, quality assurance, and customer-support functions. The Indian subsidiary is a critical component of Cloudium's global development capability and operates as a captive services center for the parent company.
• Cloudium Solutions GmbH, incorporated in Berlin, Germany. This subsidiary employs approximately 400 individuals and is responsible for sales, customer success, and localized support functions in the DACH region (Germany, Austria, and Switzerland).
In addition to the foregoing, Cloudium maintains smaller legal entities and branch offices in several other jurisdictions, none of which are material to the CFIUS analysis. A complete list of Cloudium's subsidiaries and affiliates was provided in the due diligence data room.
D. Key Stakeholders
The following individuals and entities are key stakeholders in the Transaction:
• Jonathan Hargrove, Chief Executive Officer of Cloudium. Mr. Hargrove holds approximately 4.2% of Cloudium's outstanding shares (approximately 7,736,400 shares). He is rolling over approximately 50% of his equity into the post-closing entity, representing rolled equity with an implied value of approximately $142,814,544 based on the per-share merger consideration.
• Sienna Whitfield, Chief Financial Officer of Cloudium.
• Nadia Chowdhury, General Counsel and Corporate Secretary of Cloudium.
• Pinnacle Growth Ventures LLC, a Delaware limited liability company and significant existing shareholder of Cloudium. Pinnacle holds approximately 11.6% of Cloudium's outstanding shares (approximately 21,367,200 shares) and has agreed in principle to roll over approximately 60% of its equity into the post-closing entity, representing rolled equity with an implied value of approximately $473,241,408. The Managing Member of Pinnacle Growth Ventures LLC is Evelyn Carmichael. Pinnacle's principal offices are located at 777 Third Avenue, 28th Floor, New York, New York 10017.
• Veridian Partners LLC is serving as financial advisor to Cloudium in connection with the Transaction. The engagement is led by Monica Pressler, Managing Director.
• Ridgeway Phelps & Sato LLP is serving as outside legal counsel to Cloudium, with Catherine Answorth leading the M&A team.
E. Government Contract Relationship
Cloudium maintains a Master SaaS Agreement (the "Aegis Agreement") with Aegis Federal Solutions Inc. ("Aegis Federal"), a Virginia corporation that serves as a prime contractor and subcontractor to various agencies and departments of the United States federal government. The Aegis Agreement provides for Cloudium to furnish its cloud-native ERP and CRM platform to Aegis Federal on a subscription basis for use in connection with Aegis Federal's performance under certain government contracts. As of the date of this memorandum, the Aegis Agreement generates approximately $84,000,000 in annualized recurring revenue for Cloudium, representing approximately 4.8% of Cloudium's total ARR.
The Aegis Agreement contains a change-of-control consent provision that requires Cloudium to obtain Aegis Federal's written consent prior to the consummation of any change-of-control transaction involving Cloudium. The deal team is separately managing the process for obtaining this consent, and the Merger Agreement will contain a covenant requiring the parties to use commercially reasonable efforts to obtain any required third-party consents. The significance of the Aegis Federal relationship from a CFIUS perspective is analyzed in detail in Part V below.
It is important to note at the outset that the Aegis Agreement involves the provision of unclassified, commercial cloud services. Cloudium itself does not hold a facility security clearance ("FCL") from the Defense Counterintelligence and Security Agency ("DCSA") and does not access, store, or process classified national security information. Cloudium holds a FedRAMP Moderate authorization for the specific environment used to deliver services under the Aegis Agreement, but does not hold a FedRAMP High authorization. The distinction between FedRAMP Moderate and FedRAMP High authorization levels is relevant to the critical-infrastructure and critical-technologies analyses below.
III. Legal Framework: CFIUS Jurisdiction
A. Overview of CFIUS Authority
CFIUS is an interagency committee of the United States government, chaired by the Secretary of the Treasury, that is authorized to review certain transactions involving foreign investment in the United States for national security implications. CFIUS derives its authority from Section 721 of the Defense Production Act of 1950, as amended (50 U.S.C. § 4565). CFIUS's authority was substantially expanded and modernized by the Foreign Investment Risk Review Modernization Act of 2018 ("FIRRMA"), which was enacted as part of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232). FIRRMA broadened CFIUS's jurisdiction to cover certain non-controlling investments in U.S. businesses involved with critical technologies, critical infrastructure, and sensitive personal data (so-called "TID U.S. businesses"), as well as certain real estate transactions near sensitive government facilities.
The implementing regulations for CFIUS are set forth in two principal parts of Title 31 of the Code of Federal Regulations:
• 31 C.F.R. Part 800 governs transactions involving the acquisition of, or certain investments in, U.S. businesses by foreign persons. Part 800 was comprehensively revised effective February 13, 2020, to implement the provisions of FIRRMA.
• 31 C.F.R. Part 802 governs transactions involving the purchase or lease by, or concession to, a foreign person of certain real estate in the United States (referred to as "covered real estate"). Part 802 took effect on February 13, 2020.
CFIUS operates through a review-and-investigation process that may be initiated either by the parties to a transaction (through a voluntary notice or short-form declaration) or by CFIUS itself (acting on its own initiative with respect to non-notified transactions). When parties submit a voluntary notice, CFIUS has an initial 45-day review period, which may be followed by a 45-day investigation period if CFIUS determines that additional time is needed. Following the investigation, CFIUS may refer the matter to the President of the United States, who has a 15-day period in which to take action, including ordering the prohibition or unwinding of a transaction. CFIUS may also negotiate mitigation agreements with the parties to address identified national security concerns.
It is important to note that CFIUS retains jurisdiction to review any "covered transaction" regardless of whether the parties have filed a voluntary notice, and there is no statute of limitations on CFIUS's authority. This residual jurisdiction is one reason that parties sometimes elect to file voluntary notices even when not strictly required — to obtain the benefit of a CFIUS "safe harbor" upon clearance. The question of whether such a filing is warranted here is addressed in Part VII below.
B. "Covered Transaction" Analysis
A "covered transaction" is defined under the regulations as any transaction by or with any foreign person that could result in foreign "control" of any "U.S. business," as well as certain "covered investments" by a foreign person in an unaffiliated TID U.S. business. 31 C.F.R. § 800.210. The term "covered transaction" is broadly construed and encompasses mergers, acquisitions, takeovers, the formation of joint ventures, and other transactions structured to provide a foreign person with control of a U.S. business. See 31 C.F.R. § 800.210(a)(1).
The threshold jurisdictional question in any CFIUS analysis is whether the acquirer (or investor) is a "foreign person." If the acquirer is not a foreign person, the transaction is not a "covered transaction" and falls outside CFIUS's jurisdiction (with the limited exception of transactions structured to evade or circumvent CFIUS review, which is not implicated here).
The term "control" is defined broadly under the regulations to mean the power, direct or indirect, whether or not exercised, to determine, direct, or decide important matters affecting an entity. 31 C.F.R. § 800.208. Control may be evidenced by, among other things, ownership of a majority of voting interests, board representation or observer rights sufficient to influence key decisions, contractual arrangements, or other means. The regulations also address "covered investments," which are non-controlling investments by a foreign person in a TID U.S. business where the investment affords the foreign person certain access rights, involvement in substantive decision-making, or access to material nonpublic technical information. 31 C.F.R. § 800.211.
C. Mandatory Declaration Requirements
FIRRMA introduced mandatory declaration requirements for certain categories of transactions. Under 31 C.F.R. § 800.401, a mandatory declaration (or, at the parties' option, a full voluntary notice) must be filed in two circumstances:
First, where a foreign person acquires a "substantial interest" (generally 25% or more of the voting interest) in a TID U.S. business, and a foreign government holds a "substantial interest" (generally 49% or more of the voting interest) in the acquiring foreign person. 31 C.F.R. § 800.401(b). This provision targets sovereign-wealth-fund and state-owned-enterprise transactions involving TID U.S. businesses.
Second, where a transaction involves a TID U.S. business that produces, designs, tests, manufactures, fabricates, or develops one or more "critical technologies" that require U.S. regulatory authorization — such as an export license under the International Traffic in Arms Regulations ("ITAR") or the Export Administration Regulations ("EAR") — for the export, re-export, transfer (in-country), or retransfer of such technologies to the foreign person that is a party to the transaction, or to foreign persons in which the acquiring foreign person holds a substantial interest, or that hold a substantial interest in the acquiring foreign person. 31 C.F.R. § 800.401(c). This provision is designed to capture transactions where a foreign acquirer could gain access to critical technologies that would otherwise require a license for transfer to the acquirer's home country.
Failure to file a mandatory declaration when required may result in the imposition of civil monetary penalties of up to the value of the transaction. 31 C.F.R. § 800.901. It is therefore critical to determine whether the Transaction triggers either of these mandatory declaration requirements.
As set forth in Parts IV and V below, neither mandatory declaration requirement is triggered by the Transaction: the acquirer is not a foreign person (and therefore no foreign government holds a substantial interest in the acquirer), and Cloudium does not produce, design, test, manufacture, fabricate, or develop critical technologies.
IV. Analysis: Acquirer "Foreign Person" Status
A. Solara's Organizational Structure
The determination of whether the acquirer in a CFIUS-reviewable transaction is a "foreign person" requires examination of the entire chain of ownership and control, from the acquiring entity up through its ultimate parent and controlling persons. Under 31 C.F.R. § 800.224, a "foreign person" is defined as any foreign national, foreign government, or entity organized under the laws of a foreign state, or any entity over which control is exercised or exercisable by a foreign national, foreign government, or entity organized under the laws of a foreign state. Conversely, a "U.S. person" is defined as a United States citizen, a lawful permanent resident of the United States, an entity organized under the laws of the United States or any jurisdiction within the United States, or any entity that is controlled by one or more of the foregoing.
We have reviewed the organizational structure of the buyer side of the Transaction in its entirety. The relevant entities in the buyer chain are as follows:
• Solara Digital Infrastructure LP — a Delaware limited partnership that serves as the parent platform entity. Solara Digital Infrastructure LP's general partner is Solara Digital GP LLC, a Delaware limited liability company.
• Solara Digital Infrastructure Fund VI LP ("Fund VI") — a Delaware limited partnership (EIN 87-4523190) and the direct acquirer of Cloudium through the merger. Fund VI has approximately $12.4 billion in committed capital. Fund VI's general partner is Solara Fund VI GP LLC, a Delaware limited liability company.
• Solara Fund VI GP LLC — a Delaware limited liability company that serves as the general partner of Fund VI and exercises investment and voting authority over Fund VI's assets and operations. Solara Fund VI GP LLC is managed by Marcus Elliston and Priya Narasimhan, both of whom are United States persons (United States citizens).
• Solara Digital Co-Invest VI-A LP — a Delaware limited partnership that will co-invest approximately $425,000,000 alongside Fund VI. This co-investment vehicle is controlled by Solara Fund VI GP LLC.
• Stratos Merger Sub Inc. ("Merger Sub") — a Delaware corporation, the sole stockholder of which is Fund VI. Merger Sub was formed solely for purposes of the Transaction and has no independent operations.
Each entity in the buyer chain is organized under the laws of the State of Delaware. The managing partners of Solara — Marcus Elliston and Priya Narasimhan — are United States citizens who exercise exclusive investment and voting authority over Fund VI through their positions at Solara Fund VI GP LLC. There is no foreign person in the chain of control above Merger Sub, Fund VI, or any other buyer-side entity.
B. Fund VI Limited Partner Analysis
While the general-partner control analysis is dispositive of the "foreign person" question under ordinary circumstances, we have also reviewed the limited partner base of Fund VI to confirm that no foreign person exercises control over fund-level decisions and to assess whether any foreign-government-affiliated limited partner holds a sufficient interest to warrant further scrutiny.
Fund VI has approximately $12.4 billion in committed capital. The limited partner base consists of a diversified mix of institutional investors, including:
• U.S. public and private pension funds;
• Sovereign wealth funds (including one or more non-U.S. sovereign wealth funds);
• University and charitable endowments;
• Insurance companies;
• Family offices; and
• Fund-of-funds vehicles.
Based on our review of the limited partner composition as of the most recent schedule provided by Solara (dated October 31, 2023), no single non-U.S. limited partner or group of affiliated non-U.S. limited partners holds a controlling interest in Fund VI or exercises control over fund-level investment decisions. Under the terms of Fund VI's limited partnership agreement, all investment authority and voting authority resides exclusively with the general partner, Solara Fund VI GP LLC, acting through its managing members. Limited partners hold only customary passive economic interests and limited consent rights (e.g., removal of the general partner upon a supermajority vote, amendment of the partnership agreement). No limited partner — whether U.S. or non-U.S. — has the power to determine, direct, or decide important matters affecting Fund VI, such as investment decisions, portfolio company management, or disposition of assets. The limited partners' passive economic interests do not constitute "control" within the meaning of 31 C.F.R. § 800.208.
We note that the presence of one or more sovereign wealth fund limited partners in Fund VI is not unusual for a fund of this size and vintage. However, the relevant question under the CFIUS regulations is not whether any foreign person holds a passive economic interest in the fund, but whether any foreign person exercises or can exercise control over the fund or the acquiring entity. Here, the answer is clearly no.
Additionally, Pinnacle Growth Ventures LLC — the significant existing Cloudium shareholder that will roll over approximately 60% of its equity — is a Delaware limited liability company managed by Evelyn Carmichael, a United States person. Pinnacle is not a foreign person.
C. Conclusion on Foreign Person Status
Based on the foregoing analysis, neither Fund VI, Merger Sub, Solara Digital Infrastructure LP, Solara Digital GP LLC, Solara Fund VI GP LLC, Solara Digital Co-Invest VI-A LP, nor any other entity in the buyer chain constitutes a "foreign person" for purposes of the CFIUS regulations. The Transaction is therefore not a "covered transaction" under 31 C.F.R. § 800.210 on the basis of the acquirer's identity. Because the acquirer is not a foreign person, the Transaction does not fall within CFIUS's jurisdiction over covered control transactions, covered investments, or mandatory declarations.
Important caveat: This conclusion is based on the current limited partner composition and ownership structure of Fund VI and the other buyer-side entities as reviewed in diligence through the date of this memorandum. Should the composition of Fund VI's limited partner base change materially before the closing of the Transaction — for example, through the assignment or transfer of limited partner interests to foreign-government-affiliated investors, or through the admission of new limited partners who are foreign persons or who are controlled by foreign persons — this analysis should be promptly revisited. Similarly, if the governance structure of Fund VI or Solara Fund VI GP LLC were to change such that a foreign person obtained control or influence over investment or voting decisions, the analysis would need to be updated. We have advised Solara that any such changes should be communicated to counsel immediately.
V. Analysis: TID U.S. Business Status of Cloudium
Even though the foreign-person threshold is not met — and the Transaction therefore falls outside CFIUS's jurisdiction as a covered transaction — we have conducted a comprehensive belt-and-suspenders analysis of whether Cloudium constitutes a "TID U.S. business." This analysis serves several purposes: (i) it provides a complete record of the regulatory assessment in the event that the acquirer's status changes before closing; (ii) it addresses the theoretical possibility that CFIUS could take an interest in the Transaction on its own initiative (however unlikely in the absence of a foreign acquirer); and (iii) it ensures that the deal team and the client have a full understanding of Cloudium's regulatory posture for purposes of representations and warranties in the Merger Agreement and for future transactions.
A "TID U.S. business" is defined under the CFIUS regulations as a U.S. business that:
(i) produces, designs, tests, manufactures, fabricates, or develops one or more "critical technologies" (31 C.F.R. § 800.248(a));
(ii) performs certain specified functions (owns, operates, manufactures, supplies, or services) with respect to "critical infrastructure" as identified in Column 1 of Appendix A to 31 C.F.R. Part 800 (31 C.F.R. § 800.248(b)); or
(iii) maintains or collects, directly or indirectly, "sensitive personal data" of U.S. citizens as specified in the regulations (31 C.F.R. § 800.248(c)).
We address each prong in turn.
A. Critical Technologies
1. Definition. The term "critical technologies" is defined in 31 C.F.R. § 800.215 by reference to several enumerated categories of controlled items, technologies, and materials. These include:
(a) Defense articles or defense services included on the United States Munitions List ("USML") set forth in the International Traffic in Arms Regulations ("ITAR") at 22 C.F.R. Parts 120-130;
(b) Items included on the Commerce Control List ("CCL") set forth in Supplement No. 1 to Part 774 of the Export Administration Regulations ("EAR") at 15 C.F.R. Parts 730-774, that are controlled for reasons related to national security, chemical and biological weapons proliferation, nuclear nonproliferation, missile technology, regional stability, or surreptitious listening;
(c) Specially designed and prepared nuclear equipment, parts and components, materials, software, and technology covered by 10 C.F.R. Part 810;
(d) Nuclear facilities, equipment, and material covered by 10 C.F.R. Part 110;
(e) Select agents and toxins specified by the Department of Health and Human Services and the Department of Agriculture at 7 C.F.R. Part 331, 9 C.F.R. Part 121, and 42 C.F.R. Part 73; and
(f) Emerging and foundational technologies controlled pursuant to Section 1758 of the Export Control Reform Act of 2018 ("ECRA") (50 U.S.C. § 4817).
2. Application to Cloudium
Cloudium's products are commercial cloud-native ERP, CRM, and business-intelligence SaaS platforms designed for enterprise and mid-market customers. The company's technology is software-based and does not involve the production, design, testing, manufacture, fabrication, or development of defense articles, defense services, controlled items on the Commerce Control List, nuclear equipment or materials, or select agents and toxins.
Based on our diligence review — including responses to the Supplemental Due Diligence Request List — Regulatory and Government Contracts, dated October 15, 2023, and the Supplemental Due Diligence Request List — IP and Technology, dated October 8, 2023, as well as interviews with Cloudium's General Counsel, Nadia Chowdhury, and Cloudium's Vice President of Engineering — we have confirmed the following:
• Cloudium's software products are not controlled under the ITAR and are not "defense articles" or "defense services" within the meaning of the USML. Cloudium does not hold any ITAR registrations with the Directorate of Defense Trade Controls.
• Cloudium's software products are classified as EAR99 under the Export Administration Regulations. They are not included on the Commerce Control List and are not subject to EAR export licensing requirements for any destination (other than the generally applicable comprehensive sanctions and embargoes administered by the Bureau of Industry and Security, which apply to all EAR-subject items regardless of classification).
• Cloudium does not develop, test, or manufacture any items included on the Commerce Control List or the USML.
• Cloudium's technology does not fall within any currently designated category of "emerging technologies" or "foundational technologies" under ECRA. While the Bureau of Industry and Security has published several interim final rules and advance notices of proposed rulemaking identifying certain emerging technology categories (including certain categories related to artificial intelligence and machine learning, advanced computing, and quantum technologies), Cloudium's ERP, CRM, and BI platforms do not incorporate or constitute technologies within these designated categories. Cloudium's use of artificial-intelligence and machine-learning capabilities in its BI platform is limited to commercial analytics features (e.g., predictive forecasting, anomaly detection) that are widely available in the commercial software market and are not subject to export controls.
• Cloudium does not engage in research or development involving nuclear technologies, select agents or toxins, or any other category of critical technology enumerated in the regulations.
3. Aegis Federal Relationship
We have given particular attention to Cloudium's relationship with Aegis Federal Solutions Inc. in the context of the critical-technologies analysis. While the Aegis Federal relationship involves the provision of cloud services to a U.S. government contractor, the following facts are dispositive:
• Cloudium provides Aegis Federal with access to its commercial ERP and CRM platform on a subscription basis. The platform is the same commercial product offered to Cloudium's other enterprise customers, deployed in a FedRAMP Moderate-authorized environment.
• Cloudium itself does not hold a facility security clearance from the DCSA. Cloudium does not access, store, or process classified national security information, and no Cloudium employees hold personnel security clearances in connection with the Aegis Federal engagement.
• Cloudium holds a FedRAMP Moderate authorization for its government-customer offering. FedRAMP Moderate authorization is a standardized security baseline for cloud services used by federal agencies to process data categorized as "moderate impact" under FIPS 199. FedRAMP Moderate authorization does not, in itself, implicate critical-technology status or indicate that the authorized service provider is involved in the production, design, testing, manufacture, fabrication, or development of critical technologies.
• Cloudium does not hold a FedRAMP High authorization. FedRAMP High authorization would be required for cloud systems processing data categorized as "high impact" under FIPS 199, which includes certain national-security and law-enforcement data. The absence of FedRAMP High authorization confirms that Cloudium's government-facing services do not involve high-impact data or classified information.
4. Conclusion on Critical Technologies
Cloudium does not produce, design, test, manufacture, fabricate, or develop "critical technologies" as defined in 31 C.F.R. § 800.215. The company's products are commercial, unclassified SaaS platforms that are not subject to export controls beyond EAR99 classification. The Aegis Federal relationship involves the provision of unclassified commercial cloud services and does not alter this conclusion. This prong of the TID U.S. business analysis is not satisfied.
B. Critical Infrastructure
1. Definition. Under 31 C.F.R. § 800.214, "critical infrastructure" refers to systems and assets, whether physical or virtual, that are so vital to the United States that the incapacity or destruction of such systems or assets would have a debilitating impact on national security. The regulations identify 28 specific critical-infrastructure sectors and subsectors in Appendix A to 31 C.F.R. Part 800, along with the specific "covered functions" that trigger TID status when performed by a U.S. business. The identified sectors include, among others:
• Telecommunications services and infrastructure (including internet exchange points, submarine cable systems, and certain wireless networks);
• Certain energy infrastructure (including refineries, LNG terminals, electric-power generation and transmission facilities, and natural-gas storage facilities);
• Financial-market utilities (including designated financial-market utilities under Title VIII of the Dodd-Frank Act);
• Defense industrial base entities (including entities that hold certain facility security clearances or are FOCI-mitigated);
• Certain water and wastewater systems;
• Certain transportation infrastructure (including airports, maritime ports, and rail systems); and
• Various other categories of critical infrastructure designated by sector-specific criteria.
To trigger TID status, a U.S. business must perform a covered function with respect to the identified critical infrastructure — i.e., it must own, operate, manufacture, supply, or service the specified infrastructure as set forth in the regulations.
2. Application to Cloudium
Cloudium provides commercial cloud-based software solutions (ERP, CRM, and BI) to enterprise and mid-market customers. Cloudium does not own, operate, supply, or service any critical infrastructure within the meaning of the 28 sectors and subsectors identified in Appendix A to 31 C.F.R. Part 800.
Specifically:
• Cloudium does not own or operate telecommunications infrastructure, including internet exchange points, submarine cable systems, wireless networks, or satellite communications systems. Cloudium is a consumer of third-party cloud infrastructure services (Meridian Technologies and Azure), not a provider of infrastructure services.
• Cloudium does not own or operate energy infrastructure, financial-market utilities, water or wastewater systems, transportation infrastructure, or any other physical or virtual infrastructure identified in the regulations.
• Cloudium's data centers are hosted by third-party cloud infrastructure providers. The company does not own, operate, or maintain data-center facilities. While certain cloud infrastructure providers may themselves be considered operators of critical infrastructure, the fact that Cloudium is a tenant of such infrastructure does not render Cloudium an operator of critical infrastructure for CFIUS purposes.
• The provision of commercial SaaS ERP/CRM services does not constitute performing a "covered function" with respect to any identified critical-infrastructure sector. Cloudium's products are business-management tools; they are not integral to the operation of critical infrastructure systems.
3. Conclusion on Critical Infrastructure
Cloudium does not perform functions with respect to "critical infrastructure" as designated under Appendix A to 31 C.F.R. Part 800. The company is a provider of commercial enterprise software and does not own, operate, manufacture, supply, or service any critical infrastructure. This prong of the TID U.S. business analysis is not satisfied.
C. Sensitive Personal Data
1. Definition. Under 31 C.F.R. § 800.241, "sensitive personal data" includes the following categories of personally identifiable information of U.S. persons, subject to certain minimum-volume thresholds:
(a) Genetic test results (including data derived from genetic sequencing);
(b) Biometric enrollment data (e.g., facial recognition templates, fingerprint data, iris scans, voiceprints);
(c) Personal financial data, including data from consumer reporting agencies, bank account numbers, credit or debit card numbers, insurance policy numbers, and investment-related data;
(d) Data in categories covered by the Health Insurance Portability and Accountability Act ("HIPAA"), including health conditions, diagnoses, treatments, and insurance information;
(e) Data that could be used to determine the location of an individual within a range of 1,800 feet or less, in certain specified categories;
(f) Non-public electronic communications, including email, messaging, and voice communications data;
(g) Data maintained or collected by an entity that targets or tailors products or services to any U.S. executive branch agency or military department, including to personnel and contractors of such entities; and
(h) Any combination of data in the foregoing categories that could be used to identify an individual and that is maintained or collected about more than one million individuals.
A U.S. business that maintains or collects such data triggers TID status only if the data is of the specified types and exceeds the specified volume thresholds set forth in the regulations.
2. Application to Cloudium
Cloudium collects and processes business contact information and enterprise-level operational data in the ordinary course of providing its ERP, CRM, and BI services. This data includes business names, employee names, business email addresses, phone numbers, job titles, and transactional data related to the customer's business operations (e.g., sales orders, purchase orders, inventory levels, financial-reporting data at the enterprise level).
Based on our diligence review — including a detailed data-mapping exercise conducted by Cloudium's privacy and data-governance team at our request and reviewed by this firm — we have confirmed the following:
• Genetic data: Cloudium does not collect, process, store, or maintain genetic test results or data derived from genetic sequencing. The company's products and services have no nexus to genetic testing, genomics, or related fields.
• Biometric data: Cloudium does not collect, process, store, or maintain biometric enrollment data, including facial recognition templates, fingerprint data, iris scans, or voiceprints. Cloudium's platform does not incorporate biometric authentication features and does not process biometric data on behalf of its customers.
• Personal financial data: Cloudium does not maintain personal financial data of individual consumers. The company operates in a business-to-business context and processes enterprise-level financial and operational data (e.g., corporate accounts receivable, accounts payable, revenue records). This enterprise-level data does not constitute "personal financial data" within the meaning of the regulations, which are directed at individually identifiable consumer financial data such as bank account numbers, credit card numbers, and consumer credit reports. Cloudium does not operate as a consumer financial services company or a consumer reporting agency.
• Health data: Cloudium does not collect, process, store, or maintain health-related data covered by HIPAA or the categories identified in the regulations. The company's platform is not designed or marketed for use in healthcare-provider, health-insurance, or clinical-trial contexts.
• Geolocation data: Cloudium does not systematically collect or maintain precise geolocation data of individuals. The company's platform does not incorporate location-tracking features, and the business contact information it maintains (e.g., business addresses) does not constitute precise geolocation data within the meaning of the regulations (i.e., data that could be used to determine an individual's location within a range of 1,800 feet or less).
• Non-public electronic communications: Cloudium's CRM platform processes certain customer-communication metadata (e.g., records of customer interactions, logged sales calls, and email communications routed through the CRM system). However, the content and metadata of these communications are maintained on behalf of and at the direction of Cloudium's enterprise customers, who are the controllers of such data. Cloudium's role is that of a processor providing a SaaS tool. Moreover, the data at issue consists of business communications in a B2B sales context, not personal electronic communications of the type targeted by the regulations (which are principally concerned with surveillance and intelligence risks). The volume and nature of this data do not meet the regulatory thresholds for sensitive personal data.
• Government-personnel targeting: Cloudium does not target or tailor its products or services to U.S. executive branch agencies or military departments, or to personnel or contractors of such entities. Cloudium's relationship with Aegis Federal Solutions Inc. involves provision of commercial SaaS services to a government contractor, not direct sales or marketing to government agencies or government personnel. Cloudium does not maintain data about government personnel, their security clearance status, or their personal information.
• Volume thresholds: Even if any of the foregoing data categories were implicated — which, for the reasons stated above, they are not — Cloudium's data holdings do not meet the threshold of identifiable data about more than one million individuals in the specified categories. The company's user base consists of enterprise customers and their authorized business users, totaling approximately 65,000 active platform users as of the most recent reporting period. The data maintained about these users is limited to business contact information and platform-usage data, not the sensitive categories enumerated in the regulations.
3. Conclusion on Sensitive Personal Data
Cloudium does not maintain or collect "sensitive personal data" within the meaning of 31 C.F.R. § 800.241 at levels triggering TID U.S. business status. The company processes business contact information and enterprise operational data in a B2B context, none of which falls within the enumerated categories of sensitive personal data or meets the applicable volume thresholds. This prong of the TID U.S. business analysis is not satisfied.
D. Overall TID Conclusion
Based on the analysis set forth above, Cloudium does not qualify as a TID U.S. business on any of the three prongs:
1. Cloudium does not produce, design, test, manufacture, fabricate, or develop "critical technologies."
2. Cloudium does not perform "covered functions" with respect to "critical infrastructure."
3. Cloudium does not maintain or collect "sensitive personal data" at qualifying levels.
Accordingly, even if the acquirer were determined to be a foreign person (which, as analyzed in Part IV, it is not), no mandatory declaration would be required under 31 C.F.R. § 800.401, and the Transaction would not constitute a "covered investment" under 31 C.F.R. § 800.211 (which applies only to non-controlling investments in TID U.S. businesses, in any event not applicable to an acquisition of 100% control). The Transaction could theoretically be reviewed as a covered control transaction if the acquirer were a foreign person, but even in that scenario, the absence of TID U.S. business status significantly reduces the risk profile and the likelihood that CFIUS would take an interest in the Transaction.
VI. Analysis: Covered Real Estate
Under 31 C.F.R. Part 802, CFIUS has jurisdiction to review certain transactions by or with a foreign person that involve the purchase or lease by, or concession to, a foreign person of "covered real estate." Covered real estate is defined as real estate that is located within, or functions as a part of, an air or maritime port; or is located within specified geographic proximity (generally within certain distances set forth in the regulations) of military installations and other U.S. government facilities identified in Appendix A to 31 C.F.R. Part 802.
The covered real estate provisions are designed to address the national security risks that may arise when a foreign person acquires an interest in real property that could afford it proximity to, or the ability to surveil, sensitive U.S. government installations and activities. Covered real estate transactions are distinct from covered transactions involving U.S. businesses and are analyzed under a separate regulatory framework.
Cloudium's U.S. headquarters is located at 600 Townsend Street, Suite 800, San Francisco, California 94103. The company leases this space under a commercial office lease; it does not own the property or the building. Based on our review of Cloudium's real estate portfolio, Cloudium does not own any real property in the United States. All of Cloudium's U.S. facilities are leased commercial office space.
We have reviewed the geographic location of Cloudium's leased U.S. facilities against the list of military installations and sensitive government facilities identified in Appendix A to 31 C.F.R. Part 802. None of Cloudium's leased facilities fall within the geographic parameters of "covered real estate" under Part 802, and in any event, the Transaction involves an acquisition of the equity of Cloudium (not a purchase, lease, or concession of real estate by a foreign person), which further limits the applicability of Part 802.
Conclusion: The Transaction does not involve the acquisition of "covered real estate" under 31 C.F.R. Part 802. The covered real estate provisions do not apply to this Transaction.
VII. Risk Assessment: Voluntary Filing Considerations
Although we have concluded that the Transaction is not a covered transaction and does not trigger a mandatory CFIUS declaration, we have considered whether it would nonetheless be advisable for the parties to submit a voluntary CFIUS notice in order to obtain the benefit of a CFIUS "safe harbor." The safe harbor provides that, once CFIUS has concluded its review (or investigation) and taken no action to block the transaction, CFIUS generally may not reopen or revisit the transaction absent material misstatements or omissions in the notice. This safe harbor can provide valuable certainty, particularly in transactions that are close to jurisdictional thresholds or that involve sensitive sectors. We have weighed the factors for and against a voluntary filing and conclude that a filing is not warranted here.
A. Factors Weighing Against Voluntary Filing
Several significant factors weigh against a voluntary CFIUS filing in this Transaction:
First, the buyer is a U.S.-domiciled, U.S.-managed private equity sponsor. Every entity in the buyer chain is organized in Delaware, and the managing partners who exercise exclusive investment and voting authority are U.S. citizens. This eliminates the primary jurisdictional hook for CFIUS review — namely, the involvement of a foreign person. CFIUS has consistently stated that its jurisdiction is directed at transactions involving foreign persons, and a purely domestic transaction does not raise the national security concerns that animate the CFIUS regime.
Second, Cloudium is not a TID U.S. business. It does not produce critical technologies, perform covered functions with respect to critical infrastructure, or maintain sensitive personal data at qualifying levels. The absence of TID status further reduces any conceivable basis for CFIUS interest.
Third, the Transaction does not involve covered real estate.
Fourth, no mandatory declaration obligation exists under any provision of the regulations.
Fifth, a voluntary filing would introduce significant delays into the transaction timeline. The CFIUS review process entails an initial 45-day review period, which may be extended into a 45-day investigation period, followed by a potential 15-day presidential review period. In total, the CFIUS process can take up to 105 days (or longer if the parties agree to withdraw and refile, which effectively restarts the clock). Given the planned signing date of January 22, 2024, and the goal of closing by June 30, 2024 (the outside date under the draft Merger Agreement), a CFIUS filing would consume a substantial portion of the available timeline and could delay closing unnecessarily. The timeline is already constrained by the need to obtain HSR Act clearance, UK CMA clearance, and other foreign regulatory approvals.
Sixth, CFIUS filing fees would be incurred without meaningful risk mitigation. Under 31 C.F.R. § 800.1101, the CFIUS filing fee is calculated based on the value of the transaction. For a transaction valued at $6.8 billion, the applicable filing fee would be $300,000 (the maximum tier). While this amount is modest relative to the deal value, it represents an unnecessary cost in a transaction where no credible basis for CFIUS jurisdiction or CFIUS concern exists.
B. Factors Weighing in Favor (and Rebuttal)
We have also considered potential arguments in favor of a voluntary filing, and address each in turn:
The Aegis Federal relationship. The Aegis Federal Solutions Inc. government-contractor relationship ($84 million ARR) could theoretically attract CFIUS interest, as CFIUS is generally attentive to transactions involving companies that have contractual relationships with the U.S. government or the defense industrial base. However, the nature of the Aegis Federal relationship significantly mitigates this concern. Cloudium provides unclassified commercial cloud services to Aegis Federal; it does not itself hold facility security clearances, access classified information, or perform classified work. The Aegis Federal contract represents less than 5% of Cloudium's total ARR and involves standard commercial SaaS services. In our experience, CFIUS does not typically focus on transactions where the target's government-related revenue is modest, the services are unclassified and commercially available, and the acquirer is a U.S. person. The risk of CFIUS intervention on this basis is negligible.
Cloudium's UK incorporation. Cloudium is incorporated under the laws of England and Wales, which could theoretically raise foreign-acquirer concerns in a different transactional context. However, the relevant question under the CFIUS regulations is not whether the target is a foreign entity, but whether a foreign person is acquiring a U.S. business. Here, the acquirer is a domestic person, and the target's foreign incorporation is irrelevant to CFIUS jurisdiction. Moreover, to the extent Cloudium's U.S. operations constitute a "U.S. business" for CFIUS purposes (which they may, given the company's U.S. headquarters, U.S. employees, and U.S. revenue), the relevant analysis is whether the acquirer of that U.S. business is a foreign person — which it is not.
Precautionary filing for safe-harbor protection. In some transactions, parties file voluntarily even in the absence of a clear jurisdictional basis in order to obtain the CFIUS safe harbor and eliminate any residual risk that CFIUS might later review the transaction on its own initiative. This approach is most common in transactions where (i) the acquirer has some foreign nexus (e.g., a dual-national managing partner, significant foreign-government LP investors, or a non-U.S. parent entity), (ii) the target operates in a sector of heightened CFIUS sensitivity (e.g., defense, telecommunications, semiconductors, artificial intelligence), or (iii) the transaction is high-profile and likely to attract congressional or media attention. None of these factors is present here in a material way. The acquirer is entirely domestic, the target is a commercial SaaS company, and the transaction, while large, does not involve a sector of heightened national security sensitivity. The incremental value of the safe harbor in this context does not justify the cost and delay of a voluntary filing.
No government stakeholder interest. We are not aware of any indication from CFIUS, any CFIUS member agency, or any member of Congress that this transaction raises national security concerns. There has been no inquiry from CFIUS or any other government body regarding the Transaction.
C. Monitoring Recommendation
While we do not recommend a voluntary filing at this time, we recommend the following monitoring steps through closing:
1. LP Composition Monitoring. Continue to monitor the limited partner composition of Fund VI through closing to confirm that no material change in foreign-person control occurs. Any proposed assignment or transfer of LP interests to foreign-government-affiliated investors, or any change in the governance structure of Solara Fund VI GP LLC that could introduce foreign-person control, should be reported to counsel immediately for reassessment.
2. Regulatory Developments. Monitor for any expansion of mandatory CFIUS declaration requirements by regulation or executive order between now and closing, particularly with respect to sectors relevant to Cloudium's business (e.g., artificial intelligence, cloud computing, data services, or SaaS platforms). The Biden Administration has signaled interest in expanding CFIUS's reach with respect to data-related transactions and AI-related investments, and new rulemaking could potentially affect the analysis. If any new regulations are promulgated that expand mandatory filing obligations in a way that could apply to this Transaction, we will reassess promptly and advise the deal team.
3. Government Contract Developments. Monitor for any material changes in Cloudium's government-contract relationships, including any new contracts involving classified work, facility security clearances, or FedRAMP High authorization, any of which could alter the TID U.S. business analysis.
VIII. Conclusion and Recommendation
Based on the analysis set forth in this memorandum, our recommendation is as follows:
We do not recommend that the parties file a voluntary CFIUS notice in connection with the proposed acquisition of Cloudium Technologies plc by Solara Digital Infrastructure Fund VI LP.
The Transaction does not constitute a "covered transaction" within the meaning of 31 C.F.R. § 800.210 because the acquirer — Fund VI, acting through Merger Sub — is not a "foreign person" as defined in the regulations. Every entity in the buyer chain is organized in Delaware, and the managing partners who exercise exclusive investment and voting authority are United States citizens. No foreign person exercises or can exercise control over any buyer-side entity.
Additionally, even if the acquirer were determined to be a foreign person, Cloudium does not constitute a TID U.S. business. Cloudium does not produce, design, test, manufacture, fabricate, or develop "critical technologies." Cloudium does not perform "covered functions" with respect to "critical infrastructure" as designated under Appendix A to 31 C.F.R. Part 800. Cloudium does not maintain or collect "sensitive personal data" of U.S. citizens at levels triggering TID status. Cloudium does not hold "covered real estate" under 31 C.F.R. Part 802.
No mandatory CFIUS declaration is required under any provision of the regulations. The risk profile of the Transaction does not warrant a voluntary filing. A voluntary filing would introduce unnecessary delay and cost without meaningful risk mitigation.
This assessment is consistent with the overall regulatory clearance strategy for the Transaction, which has been coordinated with the following parallel workstreams:
• HSR Act filing (planned for February 9, 2024), which is being prepared by this firm's antitrust team;
• UK CMA Merger Notice (planned for February 12, 2024), which is being prepared in coordination with our London office;
• EU Merger Regulation analysis, which is being conducted to determine whether a European Commission filing is required (preliminary assessment suggests the Transaction falls below EU turnover thresholds);