Understanding the UK’s national security and investment regime

The implementation of the UK’s new investment screening regime in January 2022 marked a watershed moment for the UK government’s ability to intervene in corporate transactions relating to the UK’s national security. The National Security and Investment (“NSI”) regime is a new regulatory hurdle that must be navigated, but should be viewed in the context of an international trend to strengthen investment screening controls.

Overview

In force from 4 January 2022, the National Security and Investment Act 2021 (“NSI Act”) gave the UK government extensive new powers to investigate transactions that could harm the UK’s national security. However, given its retroactive effect, the NSI regime actually applies to any qualifying transaction which completed on or after 12 November 2020, meaning these powers, held by the Department for Business, Energy and Industrial Strategy (BEIS) span a much longer period.

Broadly, these rules govern a significant amount of M&A activity impacting the UK, with some transactions subject to mandatory notification and others subject to a voluntary regime. Ultimately, the UK government is able to impose conditions on acquisitions which raise national security concerns, including in some circumstances unwinding or blocking an acquisition. There are also related civil and criminal penalties for non-compliance, so this isn’t a regulatory development which can be ignored.

How does this regime change the regulatory landscape in the UK?

The UK government’s previous powers to scrutinize transactions on national security grounds were contained in the Enterprise Act 2002 (“Enterprise Act”) under the public interest regime, which continues in force to cover other public interest considerations. In particular, before January 2022, the Enterprise Act enabled the UK government to issue public interest intervention notices – known as PIINs – on certain strictly defined public interest considerations:

• media plurality;
• financial stability;
• national security; and
• (since June 2020) public health emergencies.

Ministers wishing to intervene under this regime must have a reasonable belief that a transaction raises one of these public interest concerns, as well as having reasonable grounds for suspecting that a transaction will result in a relevant merger situation.

However, very few transactions were subject to national security or wider public interest interventions under the Enterprise Act, with the UK government’s impact assessment relating to the new regime giving a sense of the scale of the change in terms of the number of transactions that are affected. It estimates that the new regime will generate 1,000 to 1,830 transactions being notified per annum, with an estimated 70 to 95 detailed NSI assessments and around 10 remedies per year. This compares with just a handful of deals being formally reviewed by the UK government each year under the public interest regime.

Qualifying acquisitions

Under the NSI Act, the new rules will apply to qualifying acquisitions, which are termed “trigger events”. A qualifying acquisition involves the satisfaction of three conditions.

1. First, there must be an acquisition of a right or interest in a “qualifying entity” or “qualifying asset”. The assessment here is relatively straightforward: a qualifying entity is any entity other than an individual, whether a company, LLP, trust, or other structure; while a qualifying asset is land, tangible moveable property, IP, or the like.
2. Second, the qualifying entity or qualifying asset is from, in, or has a connection to the UK. As the reader will note, this condition is very broad and could include, as an example, the acquisition of a factory in France which produces vaccines for use in the UK.
3. Finally, the level of control acquired over the qualifying entity or qualifying asset must meet or pass a certain threshold. Here, again, the rules take a broad approach, but essentially this condition will be satisfied if the acquirer:
   • takes a shareholding or voting interest in the target that crosses the 25%, 50%, or 75% thresholds;
   • acquires voting rights that allow it to pass or block resolutions; or
   • acquires an interest which allows it to materially influence the policy of an entity or direct the use of an asset (though this level of control is not sufficient for the mandatory regime).

With respect to this final threshold, this concept is the same as that used in UK competition law, with the relevant consideration being whether the acquirer can materially influence the management of a target’s business, including its strategic direction and its ability to define and achieve its commercial objectives. Guidance is available from the Competition and Markets Authority, the UK’s competition regulator, on this topic.

Mandatory and voluntary

As noted, the NSI Act establishes a hybrid model in which there will be mandatory notification requirements in certain specified areas of the economy, with a voluntary regime for all other qualifying acquisitions. This approach, with both mandatory and voluntary processes, is consistent with (and has drawn on) the approach in the US, Germany, and Australia.

Turning to the mandatory part of the regime first: parties will be legally required to notify the UK government about acquisitions of qualifying entities in seventeen sensitive areas of the economy, where they will be required to get clearance before completion. These areas are those where the UK government considers there are enhanced risks to national security, as follows:

• Advanced Materials;
• Advanced Robotics;
• Artificial Intelligence;
• Civil Nuclear;
• Communications;
• Computing Hardware;
• Critical Suppliers to Government;
• Cryptographic Authentication;
• Data Infrastructure;
• Defence;
• Energy;
• Military and Dual-Use;
• Quantum Technologies;
• Satellite and Space Technologies;
• Suppliers to the Emergency Services;
• Synthetic Biology; and
• Transport.

The exact scope of these areas is prescribed in a huge amount of detail in secondary legislation and official guidance. For now, however, it’s important to emphasize that failing to notify a qualifying acquisition in a mandatory sector will result in the acquisition being void. Further, there are related civil and criminal penalties, e.g. a civil penalty could require an infringing party to pay up to 5% of its organization’s global turnover or £10 million, whichever is greater. A nuance which needs to be flagged here is that the mandatory part of the regime only applies to acquisitions of qualifying entities, not qualifying assets, as these fall only within the voluntary part of the regime.

Turning to this part of the regime, if a transaction is a qualifying acquisition in an area outside of a mandatory sector, or is an acquisition of assets within a mandatory sector, then it will be subject to the voluntary regime. This means that the parties have no obligation to inform the UK government of the transaction. However, if the UK government reasonably suspects that it might give rise to a national security risk, it may be “called-in” for review. In particular, the UK government will be able to assess acquisitions for up to five years after they have taken place and up to six months after becoming aware of them if they have not been notified.

It is anticipated that the voluntary part of the regime will be approached differently by different businesses, possibly due to either differing levels of internal risk appetite or enforced commercial requirements, e.g. where a seller refuses to accept a conditional transaction.

Assessment under the regime

As noted, the powers granted to the Secretary of State under the NSI Act seek to protect the UK’s national security; however, the UK government intentionally does not set out the exhaustive circumstances in which national security is, or may be, considered at risk. This is longstanding policy to ensure that national security powers are sufficiently flexible to protect the nation.

That said, a UK government statement dated 2 November 2021 sets out that the Secretary of State is likely to use the call-in power where there may be a potential for immediate or future harm to UK national security, which it states “includes risks to governmental and defense assets (infrastructure, technologies and capabilities), such as disruption or erosion of military advantage; the potential impact of a qualifying acquisition on the security of the UK’s critical infrastructure; and the need to prevent actors with hostile intentions towards the UK building defense or technological capabilities which may present a national security threat to the UK”.

But what does this actually mean?

Helpfully, the statement goes on to identify the risk factors that will be considered by the Secretary of State in making his or her assessment:

• Target risk – this concerns whether the target is being used, or could be used, in a way that raises a risk to national security. Principally, the Secretary of State considers that entities which undertake activities in the seventeen mandatory sectors, or closely linked activities, are more likely to raise a target risk. However, the assessment of target risk should also involve consideration of any national security risks arising from the target’s proximity to sensitive sites (examples of such sensitive sites include critical national infrastructure sites or UK government buildings);
• Acquirer risk – this concerns whether the acquirer has characteristics that suggest there is, or may be, a risk to national security from the acquirer having control of the target. The Secretary of State will consider whether the acquirer poses a risk to national security. Characteristics of the acquirer such as the sector of activity, technological capabilities, and links to entities which may seek to undermine or threaten the national security of the UK are likely to be considered in order to understand the level of risk the acquirer may pose. Some characteristics, such as a history of passive or long-term investments, may indicate low or no acquirer risk, and the Secretary of State does not regard state-owned entities, sovereign wealth funds, or other entities affiliated with foreign states as being inherently more likely to pose a national security risk;
• Control risk – this concerns the amount of control that has been, or will be, acquired (and a higher level of control may increase the level of national security risk).

There is, therefore, a framework in place which allows parties to assess the risk associated with the NSI regime, albeit that there is little information in the public domain that allows businesses and practitioners to assess the wider impact of the regime at this date.

The finer points

The NSI regime raises a number of issues when its finer details are considered.

One key takeaway is that corporate restructurings or reorganizations can be caught, including by the mandatory regime. This goes further than many who are used to dealing with M&A activity, including competition practitioners, will anticipate, particularly given the single economic entity concept widely used in UK and international merger control regimes, and also many FDI regimes.

Another is that the UK government can assess a potential qualifying acquisition that has not yet happened if it reasonably suspects it may cause a national security risk. For example, if the parties to a transaction have signed heads of terms, the UK government is able to call-in that transaction if it anticipates national security concerns. This again is a material divergence from many other regulatory regimes, including most merger control regimes.

A further quirk which may not be anticipated by businesses is that the regime is nationality agnostic when it comes to jurisdiction, meaning acquisitions by UK acquirers will be caught in the same manner as acquisitions by foreign acquirers. Clearly, nationality will feed into the assessment of acquirer risk, but it will not negate the need to carry out a full assessment of the regime.

Finally, and this is a point identified above but which is worth reiterating due to its importance, the regime applies to UK-based entities and assets – which is expected for an FDI regime – but also to UK-connected entities and assets. This is less usual and so businesses must be on the ball when making acquisitions of potentially relevant qualifying entities or assets.

Conclusion

The NSI regime therefore presents a number of new challenges for businesses, adding to the increasing regulatory burden imposed on M&A participants in the UK, echoing a trend seen globally.

For further insight into the regime and its particular impact on those sectors most affected, please listen to the Understanding the UK National Security & Investment Regime Podcast series.