How will the UK government’s new national security powers impact M&A?

After receiving final approval in the spring of 2021, the UK government’s new National Security and Investment Act came into force on January 4th. The new rules were introduced in response to long-standing calls for more to be done to protect the UK from M&A transactions that could potentially compromise its national security.

The act provides the government with significant oversight to investigate, assess and potentially intervene in certain types of deals that could have national security implications or that take place in sectors considered important to national security.

As a result of this, and given the broad scope of the new powers contained in the act, it is being widely forecast that the act will have considerable implications for domestic and inbound M&A activity within the UK.

What are the new powers?
The act equips the government with an array of new powers relating to deals involving UK companies or assets. The powers in question are being conferred on the Secretary of State for Business, Energy and Industrial Strategy (BEIS), which will enforce the act via the newly-created Investment Security Unit (ISU).

Perhaps the most significant aspect of the act is mandatory notification, which stipulates that certain types of acquisitions involving shares or voting rights in companies operating in “sensitive sectors” of the economy require notification be given to the government.

Until the government has reviewed such a deal and given its approval, completion of the transaction is prohibited. Should a deal that is subject to mandatory notification be completed without government approval, the transaction will become void once the government becomes aware of it, with the deal’s non-notified completion constituting a criminal offence.

Due to the severity of voiding transactions entirely, the act also enables retrospective validation in appropriate instances. While sanctions can still be imposed upon parties seeking retrospective validation, going through this process could avoid the consequences of initially failing to seek or obtain clearance and potentially salvage the deal.

The act also means that the government can investigate deals that involve the acquisition of “control or influence” over a qualifying asset or entity, whether or not it has been notified of the deal. As well as mandatory notification for deals in sensitive sectors, the act introduces a system of voluntary notification for deals that do not require mandatory notification, but which may nonetheless have potential implications for national security.

If voluntary notification is not given and a deal is thought to have potential national security ramifications, the government has the power to investigate the transaction within 6 months of being made aware of it, providing this happens within 5 years of the deal’s completion.

Furthermore, the act empowers the government to impose remedies to resolve or address any perceived risk to national security, including potentially prohibiting a transaction if deemed necessary, as well as the ability to impose sanctions for non-compliance. Finally, all the powers included in the act have retrospective application covering any deal completed from November 12th 2020 onwards.

What deals fall under the act?
The remit of the act is broad, with the powers applying to acquisitions involving any entity or asset based in, or having a sufficient connection to, the UK. Under the rules, qualifying entities are classed as being any company, limited liability partnership, corporate body, partnership, trust or unincorporated association which is either based in the UK or supplies goods and services to the people of the UK.

Qualifying assets, meanwhile, include land, tangible moveable property, or intellectual property with industrial, commercial or other economic value, which are either based in the UK, used in connection with activities carried on in the UK or used in connection with the supply of goods or services to the people of the UK.

Mandatory notification is applicable when a “trigger event” takes place. A trigger event includes any transaction involving an entity in a sensitive sector in which:

- the acquiring party takes on 25 per cent or more of shares or voting rights in the target business.

- the acquisition of new shares or voting rights takes the acquiring party from: under 25 per cent of voting rights to 25 per cent or more; under 50 per cent to 50 per cent or more; under 75 per cent to 75 per cent or more.

- the acquiring party gains sufficient voting rights to enable or prevent the passage of any class of resolution.

- the acquisition of a stake of under 25 per cent in which the acquisition is considered to confer “material influence”.


What are the National Security criteria?
Even if a transaction is not subject to mandatory notification, the government retains the power to “call-in” any qualifying transactions for assessment. In this instance, the government will use three key criteria to assess potential national security considerations.

Firstly, target risk. This covers the nature of the entity or asset being acquired, whether it is important to UK national security or is in a sector in which national security risk is considered more likely.

Secondly, trigger event risk, which looks at the type of control being conferred in the acquisition, how this may be utilised in practice and whether, ultimately, it gives the buyer the ability to undermine UK national security.

Finally, acquirer risk. This looks at how much the party conducting the acquisition raises concerns with regard to the UK’s national security and whether they are likely to use their control of the target to undermine national security.

What sectors fall under the remit of mandatory notification?
Mandatory notification applies to acquisitions of qualifying entities in 17 sectors which have been designated by the government as being sensitive parts of the UK’s economy from a national security perspective. These sectors are:

• Advanced materials
• Advanced robotics
• Artificial intelligence (AI)
• Civil nuclear
• Communications
• Computing hardware
• Critical suppliers to government
• Cryptographic authentication
• Data infrastructure
• Defence
• Energy
• Military & dual-use
• Quantum technologies
• Satellite and space technologies
• Suppliers to the emergency services
• Synthetic biology
• Transport


ISU assessment
The ISU has 30 working days from the submission of a mandatory or voluntary notification to determine whether the transaction can be cleared or to exercise its call-in power. If it does issue a call-in notice for either a mandatory or voluntary notification, the Secretary of State has an additional 30 working days in which to conduct an assessment of the acquisition and its potential national security risks.

This assessment period can then be extended for a further 45 working days if necessary. In the event of an in-depth assessment of the deal, the ISU can impose an order prohibiting action - such as finalising the deal - pending the result of the investigation.

These timeframes mean that the potential total review time for a transaction is 105 working days, roughly equivalent to five months. At the end of the assessment period, the ISU can either: approve the deal; approve it subject to certain conditions preventing or mitigating any national security risk; prohibiting the deal or ordering it to be voided if it has already been completed.

Implications for dealmakers
While it is unlikely that a significant number of deals will fall under the full scope of mandatory notification, and even less likely that many deals will be prohibited, the new powers do pose considerable new challenges for dealmakers conducting acquisitions in the UK.

Overall, the government forecasts that just 70-95 deals each year will require national security assessment and that only 10 per year will require remedies. However, it expects to receive 1,000-1,830 notifications per year. This indicates that, while the ISU is only predicted to intervene very rarely, a significant number of deals are still expected to justify notification. If notifications are not submitted, then such deals could be subject to government call-in.

This means that buyers and sellers will need to be proactive in assessing whether a deal has any potential national security aspects that would necessitate voluntary notification. If so, steps will need to be taken to notify the government. If these are not taken, then the deal could be subject to call-in by the ISU and potentially even be prohibited, up to five years post-completion.

While this will doubtless add an undesirably complex and time-consuming layer of due diligence, some have forecast that voluntary notification could come to be seen as a positive aspect of the dealmaking process and a reliable way of managing risk and increasing confidence among buyers and sellers.

Another potential implication is that the new rules will prove a barrier to in-bound UK M&A, with international buyers possibly being put off targeting UK companies and assets due to the more stringent new rules and regulatory loopholes. After all, among the perceived key motivations behind the act were concerns that the UK was too open to potentially sensitive foreign takeovers.

Several major deals involving acquisitions of UK companies by international buyers have provoked widespread opposition in recent years. For example, Nvidia’s takeover of chip manufacturer Arm and the $5 billion takeover of UK defence firm Cobham by US private equity outfit Advent in 2019.

Advent’s takeover of Cobham was approved following a CMA investigation and with some conditions imposed on the transaction. After this, under Advent’s ownership, Cobham moved to acquire key Royal Navy supplier Ultra Electronics, in a deal that prompted considerable furore and could still be referred for an in-depth probe over national security concerns.

With the new act now in place, it’s possible that such takeovers will be less frequent, or at least more closely regulated and scrutinised. However, the vast majority of inbound investment in the UK is not as controversial and shouldn’t face much more disruption than domestic M&A.

Indeed, as outlined in our recent 2022 UK M&A outlook, inbound M&A into the UK is expected to remain hugely popular this year and potentially even grow. In an Ansarada study cited in our outlook piece, conducted with full knowledge of the incoming rules, 40 per cent of dealmakers polled said they expected the UK to become an even more attractive market for foreign buyers this year, indicating that international appetite has not been dampened by the act.

Steps dealmakers can take
Given the wide-ranging implications of the act, dealmakers across a huge number of sectors (far more than the 17 designated as sensitive) will need to begin factoring it into their M&A processes in order to manage the risk of deals being called in by the ISU and subject to investigation and remedies.

Fundamentally, of course, any deal involving a qualifying entity or asset and involving a trigger event will require that mandatory notification be submitted. While retrospective validation is still possible under the new regime, this is far too great a risk to represent a serious option in any acquisition and should only be viewed as a step to take if mandatory notification is mistakenly not submitted.

For deals subject to mandatory notification and in transactions not requiring notification but in which a call-in is considered likely, both buyers and sellers will likely need to conduct extra due diligence. This will be necessary in order to assess the risk of the deal being either prohibited or having conditions imposed upon its approval.

Both parties will be required to conduct due diligence examining the national security risk inherent in the deal. For buyers, establishing whether the asset or entity being acquired potentially poses national security complications (target risk) will be key. A target company’s activities should be reviewed to establish whether any element of their business could be considered to pose target risk that might require notification or potentially lead to an ISU call-in if notification is not given.

Crucially, there will also be greater onus on sellers to establish acquirer risk. This will involve conducting extensive due diligence on potential buyers to establish whether there are any grounds under which the ISU may consider them a national security risk. Failure to do so could result in a retrospective call-in, as well as potential remedies, sanctions, or even the complete unwinding of the deal.

In instances where it is possible, but not certain, that the ISU will look into a transaction, dealmakers will need to decide whether to submit voluntary notification. While voluntary notification removes the risk of a call-in after the fact, not to mention possible sanctions or remedies, deals that are time sensitive might suffer as a result of delays caused by an ISU investigation. In such a case, dealmakers will need to weigh up which risk is greater.

If a transaction does require mandatory or voluntary notification, potential delays will need to be factored into the planning of the deal. While the full 105 working day delay may be a rare occurrence, it is yet to be reliably seen how promptly the ISU will deal with notification submissions, so dealmakers will need to be wary and prepare for a potentially considerable delay before the transaction can close.

Other risks associated with ISU review will also need to be considered. For instance, how likely is it that the ISU will impose conditions on the deal’s approval? If it does, what concessions can be accommodated without seriously risking the deal? Finally, of course, in particularly risky deals, the chances of the transaction being prohibited will also need to be assessed. In order to minimise the disruption that this would cause, it may be advisable, in certain deals, to make seeking ISU clearance one of the first steps.

Transactions completed since November 12 2020
The above steps taken to assess whether potential deals will be scrutinised under the new act will also apply retrospectively for deals completed since November 12 2020, which fall under the remit of the new rules.

If any deals completed since that date would require mandatory notification or risk call-in, these should be disclosed to the ISU. Proactive disclosure will reduce the call-in limitation period to six months from January 4 2022 (as opposed to five years) and also help to gain retrospective validation and secure the deal.

Clearly, the National Security and Investment Act will have far-reaching consequences for many dealmakers targeting companies or assets that have a potential bearing on UK national security. Factoring this into transactions will have an effect on due diligence processes and, perhaps most significantly, the time taken to complete sensitive transactions.

While this may prove damaging to some deals, the actual chances of prohibition will remain low for most transactions. The best approach that dealmakers can take with regard to the rules is to earnestly assess any national security risks posed by potential deals and, if mandatory notification is required or voluntary notification seems advisable, to be proactive, rather than risk future consequences.

Share this article

Latest Businesses for Sale

View more businesses for sale