Since 2021, the Swedish Security Protection Act (Security Act, Sw. Säkerhetsskyddslagen) requires that any transaction involving a Swedish entity operating security-sensitive activities or assets must be notified and receive approval from one of the reviewing authorities before completion. This being said, Sweden still does not (yet) have a general FDI screening requirement for transactions not coming under the Security Act.

Recent updates

• After a proposal for a more general FDI screening framework was presented by the Direct Investment Inquiry (Sw. Granskning av utländska direktinvesteringar) in November 2021, many expected that a general FDI screening framework would be adopted during the course of 2022 and be implemented in 2023. However, no formal proposal has yet been put forward by the Swedish government or adopted by the Swedish parliament. Hence, Sweden remains a country without a general FDI screening mechanism
• The Security Act has been subject to updates during 2022, but such amendments have not resulted in any major changes for the FDI screening process
• In addition to the updated legislation, several of the 13 reviewing authorities under the Security Act have updated their internal instructions (Sw. föreskrifter) to ensure that their procedures correspond with the updated Security Act. For example, it is now specified in the instructions issued by the Swedish Security Police that the application for a consultation in connection with a transaction shall include a description of the intended transaction, a security assessment and information about the acquirer and its ownership structure

Who files

The notification under the Security Act must be submitted by the seller. The notification shall be submitted to the relevant reviewing authority, which differs depending on the target company's activities or, in case of a public entity, the geographic location of its activities. Moreover, it is the seller that is responsible for the assessment of the applicability under, as well as compliance with, the obligations of the Security Act.

The seller should first conduct a security assessment to identify the specific activities, assets or information that the investor may get access to following the transaction. Based on the security assessment, the seller shall determine if the transaction is appropriate from a security protection point of view. The assessment of appropriateness shall be documented. If the assessment of appropriateness leads to a conclusion that the transaction is appropriate, the seller shall consult with the relevant authority by submitting a notification including the underlying assessments and general information about the parties and the transaction. The transaction cannot be completed until such consultation has been completed.

Types of deals reviewed

A transaction must be notified if it involves a Swedish entity that carries out security-sensitive activities, has assets that are considered security-sensitive or has access to security-sensitive information, also known as classified information (security-sensitive activities). It falls upon the target company and/or its seller to assess whether the operations of the entity fall under the concept of security-sensitive activities. If the outcome of the assessment is that the entity's operations fall under the notification obligation, the seller must follow the notification procedure set out in the Security Act.

The obligation by the seller to notify applies to both Swedish and foreign (EEA and non-EEA) investors. Moreover, there are no specific thresholds with respect to acquired shareholding or control. The Security Act refers to the transfer of the whole or a part of the target entity. Only the transfer of shares in public limited companies is explicitly exempted.

The concept of security-sensitive activities, assets or information is broadly defined by the Security Act as activities that are important to Sweden's security or are covered by international protective security commitments binding for Sweden. Some further guidance can be found in the preparatory works to the Security Act, which mention sectors such as defense, law enforcement, energy and water supplies, vital infrastructure, telecommunications and transport that would be considered security-sensitive.

Scope of the review

If the assessment of appropriateness leads to the conclusion that the transaction is not appropriate from a protective security point of view, the transaction may not be completed.

The reviewing authorities have the powers to block a transaction or approve it subject to commitments. Moreover, if the seller fails to notify a transaction that falls under the scope of the Security Act, a consultation procedure may be initiated ex officio and the transaction can be prohibited and held to be null and void, even post-closing.

According to limited and non-binding guidance issued by the Swedish Security Police, a transaction is considered inappropriate if the acquirer's access to the target's assets or operations may cause risks to national security. The target's operations or assets may also be of such a nature or such a significance for national security that a transfer of these to the acquirer is in itself inappropriate. Moreover, a transaction may be inappropriate if the acquirer represents foreign interests. The test is linked to a central question: What would the effects of a hostile action, such as an attack, espionage or an interruption of the target's business, products or services, have on Sweden's national security?

In order to trigger the need for security protection, the effects on national security must be material and measurable. For example, given that Sweden's population is largely geographically diverse and mainly concentrated in the Stockholm region, security concerns in relation to certain activities located in Stockholm will likely have a greater impact on national security compared to similar activities located in scarcely populated areas.

Review process timeline

There is no official timing for the review process. However, the reviewing authorities have an obligation to comply with general Swedish administrative rules, which require that the procedure is handled swiftly. A decision should normally be issued within one to two months, but there is no guarantee that this will be the case, and no direct recourse is available if a process is delayed. The Swedish government has stated that it is looking into this issue, meaning that this may be changed in the future.

How foreign investors can protect themselves

Although the Security Act has been in force since the 1990s, it has traditionally been a concern for a limited group of companies and government entities. The recent amendments, requiring certain investments to be notified, have thrown protective security issues into the spotlight of Swedish transactions. As the applicability of the Security Act is based on a self-assessment, target companies are now expected to be aware of the Security Act and whether it applies to their operations.

In view of the novelty of the notification obligation, there is limited guidance on the sectors and industries covered by the Security Act as well as the review process. A case-by-case assessment of the target is therefore recommended in every deal.

An investor who aims to invest in any of the highlighted industries (defense, law enforcement, energy and water supplies, vital infrastructure, telecommunications and transport) should anticipate an assessment of the target company's services or products, assets, information accessed or stored and customers in order to draw a conclusion on the applicability of the Security Act. As pointed out above, the responsibility for the assessment of the applicability of the Security Act as well as the notification lies on the seller and prior clearance should be a condition of any prospective deal.

_{White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.}

_{This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.}

_{© 2023 White & Case LLP}