National Security and Investment Act: FAQs

It aims to protect the UK’s national security from hostile foreign parties using ownership of, or influence over, UK businesses and assets.  Importantly, however, the Act does not specifically limit its scope to foreign acquirers and investors.  It applies equally to domestic parties.  In certain circumstances it can also catch acquisitions of non-UK entities or assets. 

For various reasons but notably because:

• it doesn’t only catch investments or acquisitions by overseas entities – it goes much further and catches domestic (i.e. UK only) transactions too with no direct foreign involvement;
• it doesn’t define “national security” – instead it lists 17 “sensitive” sectors which are considered strategic enough to require a mandatory notification to the UK Government should a trigger event (as detailed in the Act) be proposed in that space; 
• the trigger events are broad and go far beyond a simple change of control (≥50%) of a relevant business or company – for more detail see the Q&A below; and
• it has retrospective effect which means a relevant transaction can be called in for review if it took place after 11 November 2020 (to ensure parties did not accelerate investments/acquisitions to avoid scrutiny).

The 17 sensitive sectors are as follows:

• Advanced Materials

• Advanced Robotics

• Artificial Intelligence

• Civil Nuclear

• Communications

• Computing Hardware

• Critical Suppliers to Government

• Cryptographic Authentication

• Data Infrastructure

• Defence

• Energy

• Military and Dual-Use

• Quantum Technologies

• Satellite and Space Technologies

• Suppliers to the Emergency Services

• Synthetic Biology

• Transport

Much greater detail about what they encompass can be found in The National Security and Investment Act 2021 (Notifiable Acquisition) (Specification of Qualifying Entities) Regulations 2021.  Helpfully, the UK Government has also published this slightly more digestible guidance on the sectors.

The sector definitions have been refined over time and are not as broad as they once were.  When looking at them, it is important to think about both the existing and potential applications of the products or services being transferred.  Do they have a dual-use nature i.e. both civilian and military use?  If so, they may well be caught by the regime, even if current use is purely civilian.  Particular examples include robotics, artificial intelligence, “advanced materials” and synthetic biology. 

It is worth also looking out for bespoke sector guidance which is being published by the UK Government on an ongoing basis, for example this Guidance for the Higher Education and Research-Intensive Sectors.

Tread carefully here.  Although your transaction may not trigger mandatory notification, you are still encouraged to make a voluntary notification if you think it might otherwise be of interest from a national security perspective. 

Additionally, the UK Government can “call-in” transactions that were not notified but which have completed since 11 November 2020 and raise national security concerns.  It can do this for up to five years after the transaction happened (although must act within 6 months of becoming aware of the relevant transaction, or within 6 months from 4 January 2022 if parties have made the Investment Security Unit aware during the transitional period). 

Whether or not a transaction is called in will depend on the Government’s assessment of three risk factors – the “target risk”, the “control risk” and the “acquirer risk”.  This Section 3 Statement sets out more detail around the matters that will be considered when assessing the risk factors above.  It is high level in nature but deliberately so to ensure the Government’s powers are sufficiently flexible to protect the nation and due to the sensitivity of national security.   Whether or not to exercise the “call-in” power will be decided by the Government on a case-by-case basis.

So it’s worth having the regime in mind at an early stage, to think through all possible angles.

You need to see if what you are planning to do constitutes a “trigger event”. 

This is where the wide scope of the regime has generated much interest and feedback because we are not just talking about a change of control (≥50%) of the relevant business or assets. It also captures minority investments, intragroup transactions and, largely, does not distinguish between solvent and insolvent transactions.

Additionally, it may extend to transactions which on the face of it involve only foreign parties/assets – if those entities (such as a target company or subsidiary) carry on activities or supply goods/services to persons in the UK (or those assets are used in connection with (i) activities taking place in the UK or (ii) the supply of goods/services to persons in the UK).

Listed below are the key types of transaction caught by the regime, with a note against each confirming if they trigger a mandatory or voluntary notification:  

*A “qualifying entity” is defined as an entity that is not an individual, so it includes companies, LLPs, partnerships, trusts and unincorporated associations.

A good question and there is missing detail on this. It is stated to be any of the following types of asset:

a) Land

A BEIS: Statement of Policy Intent indicates that intervention in asset acquisitions such as pure land acquisitions is expected to be very rare. However, where assets are integral to a high risk sector entity's activities or, in the case of land, the asset is, or is proximate to, a sensitive site (such as critical national infrastructure sites or government buildings), their acquisition is more likely to be called in for review. The intended use of the land will also be of relevance. 

However, with no register of sensitive sites (e.g. national infrastructure sites or government buildings), purchasers of land will not easily be able to identify whether the target property is proximate to any sites which would cause national security concerns. Furthermore, the concept of proximity to sensitive sites is itself lacking clarity: how near does land need to be to a sensitive site to cause concern? The above Statement of Policy Intent gives an example of the acquisition of land “adjacent to” a sensitive Ministry of Defence facility which would likely raise national security concerns. The position is less clear where the land acquired is not directly adjacent to a sensitive site but still somewhat proximate.

Although not expressly defined in the Act, “land” is generally understood to include both freehold and leasehold land, any mines and minerals beneath land (which can be bought and sold separately from the land itself), and interests in land such as rights of way. It is likely that the Act’s provisions will apply equally to these interests.

The acquisition of a part share in land (as opposed to outright ownership) may be subject to voluntary notification and "call-in" if it provides the ability to use, or direct or control how the land is used.

Importantly, land assets fall outside of the exclusion contained in the Act in respect of asset acquisitions made by an individual for purposes that are wholly or mainly outside the individual’s trade, business or craft. Therefore, voluntary notification and "call-in" may apply, for example, to the purchase of a property for use as a residence.

If the land asset is situated outside the UK, it will only be a qualifying asset if it is used in connection with activities carried on in the UK or the supply of goods or services to persons in the UK.

b) Tangible (or, in Scotland, corporeal) moveable property

As noted above, the UK Government expects its intervention in asset acquisitions to be very rare.

In its Statement of Policy Intent it says that the types of tangible moveable property of greatest national security interest will vary across sectors but are likely to be closely linked to activities in core areas such as national infrastructure sectors defined by the Centre for the Protection of National Infrastructure, advanced technology, military and dual-use technologies, and direct suppliers to Government and the Emergency Services.

Examples of such assets may include physical designs and models, technical office equipment, and machinery.  Very specific examples are outlined in the Statement.

If this type of asset is situated outside the UK, it will only be a qualifying asset if it is used in connection with activities carried on in the UK or the supply of goods or services to persons in the UK.

c) Ideas, information or techniques which have industrial, commercial or other economic value

The Act sets out specific examples as follows:

• trade secrets
• databases
• source code
• algorithms
• formulae
• designs
• plans, drawings and specifications
• software

Note that Government guidance has helpfully clarified that asset acquisitions which are not linked to the 17 sensitive sectors (set out in our response to the question above) are rarely expected to be called in for review.

That is not the intention. The Secretary of State has emphasised that they do “not ordinarily expect national security risks to arise from the routine provision of goods or services between businesses” and that “asset acquisitions made by an individual for purposes that are wholly or mainly outside the individual’s trade, business or craft are (with the exception of land and some items on the export control list) not within scope of the regime”.  

The UK Government is going to be primarily interested in a change of control or influence over the underlying design etc. (see (c) in answer directly above) of the products.

However, that said, it is worth looking at your business in the round. If you are selling a significant number of potentially “sensitive” products into what might questionably be considered a hostile foreign country or hands, it would be worth seeking advice on whether this somehow triggers a notification obligation. The position isn’t yet definitive on this but will hopefully be clarified as time passes.

The proposed “acquirer” of the control or influence:

• must submit a clearance application to the UK Government’s Investment Security Unit (ISU), if the trigger event requires mandatory notification;

• should consider making a clearance application to the ISU, if there is only a voluntary notification requirement. The benefit of making such a submission is that, assuming your transaction gets the green light, the ISU won’t then issue a “call-in” notice after completion.

These Regulations set out the information which must be included when making a mandatory, voluntary or validation application (you can apply for retrospective validation if you have completed a notifiable acquisition without notifying).

The ISU has 30 working days from notification to carry out an initial assessment of the transaction. If they decide following this to undertake a more detailed review, a second 30 working day period begins which can be extended by an additional 45 working days.

Unless the ISU advises otherwise, you can still progress things on your transaction in the meantime but, where a mandatory notification is pending approval, you cannot go ahead and complete your transaction.

If your transaction requires mandatory notification and you go ahead without ISU approval, then:

• the transaction will be legally void
• a fine of up to 5% of worldwide turnover or £10 million (whichever is greater) can be imposed on the acquirer; and
• imprisonment of up to five years for the acquirer (or their officers, if the breach happened with their consent, connivance or neglect). 

If your transaction triggers only a voluntary notification obligation, the above sanctions do not apply but the ISU can “call-in” your transaction subsequently for review. If the ISU does this and decides that a national security risk has arisen, it can impose necessary and proportionate remedies for the purpose of preventing, remedying or mitigating that risk.  What that practically means is likely to vary across the risks identified. A final order might, among other things, include provisions:

• requiring a person to do or not do particular things
• requiring the appointment of a person to conduct or supervise certain activities
• restricting access to sensitive sites, confidential information and/or supply chains
• relating to the transfer of intellectual property
• as a last resort, requiring the transaction to be unwound. 

A business or asset sale by a company in an insolvency process is not exempt from the scope of the Act.  Potential buyers will need to take into account all of the issues raised above when buying from an insolvent entity. 

Insolvency practitioners will be aware of the potential risk of a share sale being declared void if a buyer does not obtain clearance where needed.  Depending upon the nature of the transaction and the underlying assets it may be possible to negotiate interim terms to deal with the delay arising from the need to obtain ISU approval. However, this approach is in no way guaranteed, and buyers seeking to acquire a high risk business or high risk assets out of insolvency should be prepared to address the insolvency practitioners’ concerns about the need for approval and the potential for delays in the process.

Insolvency sales are almost always business or asset sales.  Potential buyers may take some comfort from the Government’s reassurance that it “expects to intervene very rarely in asset transactions”. However, it remains the case that these transactions will still fall within this regime if the business or assets are high risk, particularly if they are assets in the 17 sensitive sectors or “closely linked” to such sectors.