Skip to main content
December 2, 2020

CFIUS—CFIUK: New Additional National Security Review of UK Acquisitions


UK merger reviews are in a state of flux with enhanced scrutiny now very likely for transactions that might affect national security. The UK government first brought in powers to review certain cases (without a mandatory obligation to notify) and then recently extended the scope of these powers. Now the UK government is going one step further by introducing a standalone notification regime, which will be mandatory and will suspend completion for transactions in key areas that are of importance to national security risk. In other areas the new regime will be voluntary.

This comes at a time when the UK Competition and Markets Authority (CMA) has become increasingly active in scrutinising M&A deals.1 The result is that in the future a significantly increased number of deals will have to undergo potentially two parallel reviews.

Coupled with a rather broad jurisdictional test and lack of safe harbours, the new regime will likely capture a wide range of cross-border transactions, with a clear impact on deal certainty, timetable, feasibility, and cost.2

The extent to which the UK government will use these powers remains to be seen, given its stated objective to ensure "the UK remains attractive to inward investment"3 and that its powers shall "be governed by the principles of necessity and proportionality".4 However, the adoption and use of such powers is a widespread phenomenon across Europe and elsewhere.

How will the current foreign investment regime change?

Under the current regime,5 the UK government has the power to intervene in foreign acquisitions on certain public interest grounds—namely national security, financial stability, media plurality, and, as of July 2020,6 public health emergencies. The scope for UK government intervention is currently limited to transactions which qualify as a "relevant merger situation" and thereby meet the jurisdictional thresholds under merger control rules,7 with no mandatory notification required even where these thresholds are met.

Since the current regime has come into force in 2002, the UK government has only intervened on national security grounds in 12 transactions. This is in stark contrast with the expected 1,000–1,830 deals the UK government estimates8 will be notified per year under the newly proposed regime.

Significantly, the new regime separates the national security review from CMA’s merger control review, so that the same deal may become subject to double scrutiny, to assess its impact on both national security as well as on competition in the UK.

The three key things you need to know about this new regime

A. Which transactions will be caught?

  • Target. The regime will capture transactions involving UK entities9 ("qualifying entities") or UK assets10 which fail to qualify as standalone businesses ("qualifying assets") in sectors which have national security implications. Transactions which involve non-UK entities or assets may still be caught by the regime if the entity is involved, or the asset is used, in either activities in the UK or the supply of goods or services to people in the UK.
  • "Core" sectors subject to mandatory and suspensory notification. Notification will be mandatory and suspensory only for transactions in specific sectors perceived to be of highest national security risk. These core sectors will be defined by secondary legislation11 and are expected to include:
  • Advanced Materials
  • Advanced Robotics
  • Artificial Intelligence
  • Civil Nuclear
  • Communications
  • Computing Hardware
  • Critical Suppliers to Government
  • Critical Suppliers to the Emergency Services
  • Cryptographic Authentication
  • Data Infrastructure
  • Defence
  • Energy
  • Engineering Biology
  • Military and Dual Use Technologies
  • Quantum Technologies
  • Satellite and Space Technologies
  • Transport

Outside these, any sector of the economy is potentially in scope; notification will be voluntary and parties are encouraged to notify "trigger events" they consider may be of interest from a national security perspective. Transactions which are not voluntarily notified will still be subject to the "call-in" mechanism described under section B below.

  • Type of transaction or "trigger event". There are no safe harbours and no minimum revenue or share of supply thresholds. Instead, equity thresholds are used to define notifiable acquisitions or "trigger events", as set out in the table below.
Trigger Events12
In relation to a qualifying entity:

1. a person acquires more than 25%, 50% or 75% of the shares or voting rights in that entity;
2. a person acquires voting rights that enable it to block or pass any class of resolution governing the affairs of that entity;
3. a person acquires "material influence" over a qualifying entit's policy; or
4. a person increases its shareholdings or voting rights in that qualifying entity above 15%.13

In relation to a qualifying asset:

5. a person acquires the ability to use or a greater ability to use the qualifying asset; or
6. a person acquires the ability to control or a greater ability to control how the qualifying asset is used.


  • Acquirer. The acquirer is the party responsible for notification under the mandatory regime. Its identity, as well as the identity of those in ultimate control, will be relevant in the assessment of whether national security risk may arise. Among the factors which will be considered are relevant criminal offences, known affiliations to hostile parties and hostility to the UK's national security. State-owned entities, sovereign wealth funds or other entities affiliated with foreign states will not be regarded as being inherently more likely to pose a national security risk.14

B. What are the key features of the review process?

  • Relevant authority. Notifications will be made to a newly established dedicated UK government unit, the Investment Security Unit. The Secretary of State for Business, Energy and Industrial Strategy (SoS) will be the key decisionmaker in the review process.
  • Mandatory versus voluntary notification. If a transaction is proposed in a core sector, then this must be notified and the parties will not be able to complete prior to approval from the SoS. If a transaction is not in a core sector (or it is not clear if it is), the parties will need to consider whether to voluntarily notify to achieve deal certainty or accept the risk of later intervention.
  • Call-in powers. Following the notification, or where a company has failed to submit a voluntary or mandatory notification for a transaction that the UK government considers has national security implications, the SoS can "call-in" the transaction (i.e., conduct an in-depth investigation on national security grounds). This power can be exercised up to five years after a trigger event, or within six months of the SoS becoming aware of the trigger event, whichever is earlier. As such, where a transaction may raise national security concerns, parties may want to consider voluntary notification to obtain certainty that a transaction will not subsequently be called-in, or otherwise publicise the transaction to ensure the SoS becomes aware.
  • Limited retroactive effects. Importantly, the "call-in" powers apply to any transactions completed on or after 12 November 2020 (i.e., the date the proposed regime was published). In this case, the five-year/six-month time limits start from the date the reform is approved by the UK Parliament and becomes law. While the actual use of these powers and associated notifications regimes and sanctions will only become effective once the regime enters into force—and in the interim the current regime continues to apply—businesses should start factoring in the possibility that these powers may be exercised for any transaction not yet closed.
  • Timetable and potential outcomes of the review. The review period is 30 working days for non-problematic cases, but may take up to 105 working days or longer in complex cases which warrant in-depth review, as illustrated below.


" "

  • Final orders. At the end of the in-depth review, a final decision will either approve, approve subject to conditions (e.g., limiting the equity level that an investor is allowed to acquire) or prohibit/unwind the transaction if deemed to pose an unacceptable risk.

Decisions may be appealed to the High Court for judicial review but the SoS has stated that the "vast majority" of transactions are likely to require no intervention and will be cleared quickly.

C. Where the mandatory regime applies, what are the consequences of not notifying?

For transactions captured by the mandatory regime once the reforms come into full effect (thus excluding transactions which could be subject to the above-mentioned limited retroactive effects), the following consequences could apply:

  • Transactions which take place without clearance are void. However, a void transaction can be retrospectively notified and, if approved, would no longer be void.
  • Fines. The acquirer may be subject to a penalty for completing a transaction without/before clearance of up to £10 million or 5% of worldwide turnover, whichever is greater.
  • Criminal sanctions. Directors could be liable to imprisonment of up to five years. 

© Arnold & Porter Kaye Scholer LLP 2020 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.

  1. See Arnold & Porter Advisory "Merger Control in the UK—Three and a Half Things You Need to Know", published on 11 September 2020.

  2. The Government's Impact Assessment estimates the new notification requirement will result in costs for businesses of around £66,000-81,000 in standard cases, which could increase to £323,000-374,000 in very complex cases.

  3. See Government's Impact Assessment.

  4. See Government's Statement of policy intent.

  5. This is enshrined in the Enterprise Act 2002.

  6. See Arnold & Porter Advisory "Merger Control in the UK—Three and a Half Things You Need to Know", published on 11 September 2020.

  7. These are a target UK turnover exceeding £70 million and/or the creation of, or an increase to, 25% or more in the parties' combined share of supply, and for certain specific sectors such as artificial intelligence, a target UK turnover exceeding £1 million and/or the target meeting (including individually) the 25% share of supply test. For more details, see Arnold & Porter Advisory "Merger Control in the UK—Three and a Half Things You Need to Know", published on 11 September 2020.

  8. See Government's Impact Assessment.

  9. This includes companies, limited liability partnerships, unincorporated associations, trusts, and any other body corporate.

  10. Including land, tangible moveable property and intellectual property.

  11. Currently subject to consultation until 6 January 2021.

  12. The "trigger events" also apply to indirect holdings, such that a person holding an interest in a parent entity of a chain is treated as holding the interest in the entity at the bottom of the chain. Furthermore, where two or more persons hold interests jointly, each party will be treated as holding the full interest, rather than a proportion each. On the other hand, taking security over shares or assets in the ordinary course is specifically excluded from the regime and will not constitute a "trigger event", unless the rights attached to the shares or assets held by way of security are exercisable only in accordance with the security holder's instructions. Rights exercisable by an administrator or by creditors while an entity is in relevant insolvency proceedings (including administration and proceedings under insolvency laws of another country) are also specifically excluded from constituting a "trigger event".

  13. Although the draft legislation does not treat this as a "trigger event in its own right", acquisitions of 15% or more in the specified, high-risk core sectors trigger a mandatory notification obligation.

  14. See Statement of policy intent.