The UK's new national security review regime goes live

On January 4, 2022, the UK's National Security and Investment Act 2021 ("NSIA") came fully into force, replacing - except for any on-going investigations - the previous much more limited "national security" review regime that existed under the Enterprise Act 2002 ("EA"). 

Since the enactment of NSIA in April 2021, the Government has issued both formal and informal guidance about the new investment review regime and supplementary regulations have been issued under NSIA to help complete the framework of the new regime.  

Much of the new regime should now be reasonably well understood by investors and their advisers and Shearman's English law lawyers are available to provide focused advice on the implications of NSIA and the impact it is likely to have on UK deal-making and related transactions as required. 

Key features of the new NSIA review regime

The regime rests on the twin pillars of:

• mandatory and voluntary notification of transactions to the Secretary of State ("SoS") that have the potential to raise UK national security concerns - unlike the old EA regime, parties cannot (or should not) wait for the Government to decide to review their deal on national security grounds
• the exercise by the SoS of its call-in power to review transactions, whether or not they have been notified to it. Unlike the EA regime, where the Competition and Markets Authority ("CMA") had something of an "advisory" role in the SoS's national security investigation, the conduct of this review will be solely a matter for the SoS. That said, under NSIA there will continue to be interaction between the CMA (which may find itself running a parallel antitrust investigation into the transaction being reviewed by the SoS) and the SoS (which may require the CMA to provide it with information and assistance reasonably required for carrying out its national security review).

Mandatory notifications and void transactions

Transactions taking place in any of 17 prescribed sectors must be notified to the SoS and failing to do this will result in the deal being void and, unlike the case for transactions that do not have to be notified, there will be no time limit on when the SoS may later investigate them after having become aware of them. The 17 sectors subject to mandatory notification are detailed in NSIA secondary legislation and currently include: advanced materials and robotics, AI, civil nuclear, critical suppliers to Government, cryptographic authentication, data infrastructure (used by key Government departments), defence, military and dual-use, quantum technologies, satellite and space technology, suppliers to emergency services, synthetic biology and, more generally, communications, computing hardware, energy and transport (port and airport infrastructure).

Voluntary notifications

NSIA provides for parties to a transaction that is not subject to mandatory notification to make a voluntary notification to the SoS with a procedure for the SoS to decide whether to issue a call-in notice that is similar to that applicable to mandatory notifications. Parties may wish to avail themselves of this process where there is any doubt about whether their transaction may give rise to a national security concern, because of the SoS's power to exercise its call-in power within six months of becoming aware of the transaction (i.e. the trigger event in relation to the transaction - see below) provided this is within five years of the transaction taking place). 

Strict timeframes for SoS review

NSIA sets out a timetable for the exercise by the SoS of its call-in power and review which is, however, capable of being extended where the SoS is not satisfied with the notification or information it is provided with. The SoS has 30 days from accepting a notification to decide whether to call in the transaction for review and a further period of 30 days in which to carry out its review, extendable by a further period of 45 days and such further period as the SoS and parties may agree. 

Conditions to the exercise of the SoS's call-in power: risk to national security and the Section 3 Statement

The fundamental condition is that the SoS must "reasonably suspect" that the relevant transaction has or may "give rise to a risk to national security". It is important to note that while a standard judicial review will be available in relation to decisions under the regime (though with a shortened timetable for bringing any claim), as might be expected for decisions relating to "national security", a "full merits appeal" will not be available (except in relation to financial penalties). 

National security is not defined in NSIA but section 3, NSIA requires the SoS to issue a statement setting out how it expects to exercise its call-in power and to review the statement at least every five years. The Section 3 Statement that has been issued provides some rather general and basic guidance. In particular:

• mandatorily notifiable transactions (and those involving any of the 17 prescribed sectors) are more likely to be called in than those voluntarily notified 
• loans, conditional acquisitions and options are unlikely to be called in for review (NSIA provides that shares charged by way of security for normal business activities will generally, pre-enforcement, be treated as held by the chargor and not the chargee)
• the "nationality" of the acquiror will not, by itself, be determinative and "the Secretary of State does not regard state-owned entities, sovereign wealth funds or other entities affiliated with foreign states, as being inherently more likely to pose a national security risk" 

Trigger events and qualifying targets

In addition, the call-in power cannot be exercised in relation to every transaction giving rise to a national security concern: the transaction must involve a "trigger event" and relate to a "qualifying entity" or "qualifying asset". 

Trigger events essentially involve a person or persons acquiring control over an entity or asset in one of four ways: (i) increasing their shareholding or voting rights interest in the target beyond certain thresholds (25%/50%/75%), (ii) acquiring voting rights sufficient to pass or defeat a resolution of the target, (iii) acquiring "material influence" over the policy of the target, or (iv) in relation to "qualifying assets", acquiring or expanding the scope of the rights to use the asset.

It is important to note that NSIA only requires the mandatory notification of transactions falling within any of the 17 sectors mentioned above where the relevant trigger event falls within cases (i) and (ii) above. However, particularly in view of what is said in the Section 3 Statement, parties would likely be advised to make a voluntary notification if their transaction involves any of those sectors whatever the trigger event may be.

It is also important to note that, unlike the position under EA in relation to both merger reviews and "public interest cases" on national security and (and certain other grounds) (and ignoring intervention by the SoS in "special public interest cases" under EA), there are no financial thresholds for transactions to be subject to review under NSIA.

Qualifying entities are very broadly defined and so include any entity, whether or not it is a legal person (but not an individual), and include non-UK entities if they have a sufficient connection to the UK - i.e. they carry on activities, or supply goods or services to people, in the UK. Qualifying assets are also broadly defined and include land, moveable property and ideas (such as databases, source codes and designs, etc.). As with non-UK entities, non-UK situated land or moveable property can be caught by NSIA if it is used in connection with activities carried on, or the supply of goods and services to persons, in the UK. 

The Government has published "informal" guidance on how NSIA can apply to non-UK acquisitions (and parties to them based outside the UK) which may provide parties with some assistance when considering whether, for example, there is a sufficient connection with the UK for their transaction to be caught by NSIA. Thus, according to the guidance, the following non-UK entities could be "in scope" for NSIA: those that carry out research or development in the UK or oversee the activities of a subsidiary carrying on activities in the UK or which have staff who travel to the UK to perform services for clients on a regular basis or which supply goods that pass through the UK while travelling to other destinations. Examples given of non-UK entities that are unlikely to be "in scope" for NSIA purposes include: those whose connection with the UK is through having UK-based staff working remotely for a non-UK office or which have owners or investors based in the UK. 

It has also published more general advice on the new regime, including on the process of submitting notifications and how notifications will be handled and reviewed.

Sanctions under NSIA

Not surprisingly, the Government has been at pains to emphasis that NSIA is not intended to discourage foreign investment in the UK. This assertion is repeated at several points in its Section 3 Statement. As with its previous EA national security powers, where, following its review, the SoS does not feel able to clear the transaction as proposed, the Government expects to be able to reach agreement with parties to the transaction on the terms of final orders that will regulate and may restrict (or in an extreme case prohibit) the transaction.   

Interim orders will be available to the the SoS to preserve the status quo pending the call-in review. Financial penalties and other criminal sanctions will also be capable of being imposed for breaches of the new regime by transaction participants.  

Impact on UK deal-making

One of the biggest concerns facing deal-makers as they look ahead to the first year of NSIA's operation must be how well the new Investment Security Unit ("ISU") which has been formed within the Department of Business, Energy and Industrial Strategy to handle the new security review process, will be able to cope with the forecast 1800 or so notifications that it is expecting to receive and the number of call-in reviews it decides to undertake. Plus the many pre-notification discussions that participants will want to have with the ISU. 

Although parties will be able to try and structure their deal around the new timetable pressures of a NSIA review by incorporating appropriate "NSIA conditions", that may not be possible where the transaction is not subject to mandatory notification and the parties are not agreed on the introduction of that sort of additional conditionality to their deal. In the case of UK public M&A governed by the Takeover Code, the Takeover Panel has helpfully indicated (in connection with the recent changes to the Code's timetable and treatment of offer conditions) that it would likely treat a NSIA clearance as a "material official authorisation or regulatory clearance" which could trigger a suspension of the Code timetable to allow the NSIA review to take place. 

While the new NSIA regime offers much greater detail on the process that the Government will undertake in reviewing deals for national security risk than was available under the EA regime, at the end of the day, almost inevitably perhaps, that review is likely to have a significant political dimension with the consequent uncertainty - as to eventual outcomes and the price to be paid for receiving security approval - that will introduce to deal-making, particularly in the increasingly important high tech sectors.

Parties will also need to be aware of the breadth of the new regime - while no doubt the transactions that will be subject to the greatest scrutiny will involve foreign acquirers, NSIA is "nationality" agnostic and even internal group re-organisations may technically be capable of triggering notification requirements, if not the exercise of the SoS's call-in power. 

One can only wish the ISU the very best with its new workload as 2022 gets underway!