Eivind J. Vesterkjær, Heidi Jorkjend and Trine Siri Dahl (Advokatfirmaet Thommessen) authored this publication.

The Norwegian Security Act contains rules on mandatory FDI filing of certain transactions involving companies that have been made subject to the Security Act. Additionally, the act empowers Norwegian authorities to intervene also in transactions concerning companies which have not been made subject to the Security Act, if necessary, due to national security interests.

Summary of major changes in 2024

• A proposal for a complete overhaul of Norway's FDI screening system was opened for public consultation in early 2024.
• In January 2025 the government submitted a report to the Norwegian parliament where it confirmed that it is working towards presenting a proposal for a new act on control of foreign investments.

Who files

Under the current regime, the filing obligation lies with the acquirer. The filing obligation applies to both foreign and Norwegian acquirers.

The filing should be submitted to the government ministry responsible for the sector in question or, if no ministry is responsible for that sector, to the National Security Authority.

Types of deals reviewed

To trigger a mandatory filing obligation under chapter 10 of the Norwegian Security Act, there must be an acquisition of a "qualified ownership interest" in a business brought under the act's scope by an administrative decision. A qualified ownership interest is defined as acquiring one-third of the shares, interests, or voting rights in the business, or gaining significant influence by other means.

Decisions to include businesses under the Security Act are made for those handling classified information; controlling vital information, systems, objects, or infrastructure; or engaging in activities crucial for national functions or security interests. Businesses of significant importance for fundamental national functions or national security interests may also be included.

Norwegian authorities do not publish a comprehensive list of undertakings that have been placed under the scope of the Security Act. However, based on available information, companies that have been made subject to the act comprise entities active in sectors such as the defence industry, telecommunications, space, finance, air and land transport infrastructure, energy, and information and communications technology. In addition, recent cases confirm that the authorities are concerned about transactions involving strategically located real estate and ports.

Scope of the review

The criterion for intervention under the Security Act is that the acquisition presents a not insignificant risk of a threat to national security interests. This criterion provides significant discretion in the authorities' review, but some guidance may be drawn from previous interventions pursuant to the Security Act.

In 2021, the Norwegian government prohibited the sale of Bergen Engines, a Rolls-Royce-owned engine manufacturer for civil and military applications, to TMH International. The ultimate owners of TMH had ties to the Russian government, raising concerns that the sale would give TMH access to the company's technology, expertise, materials, real estate, customer portfolio, and contracts. Additionally, Bergen Engines' location in a strategically important port heightened the national security risk.

In 2023, the government conditionally approved the acquisition by Mubadala Investment Company of a minority interest in GlobalConnect, a provider of fibre internet services. The conditions that were imposed entailed measures to prevent sensitive information concerning national security from being obtained by unauthorised persons, ensuring prior control of future changes in the ownership of the business, and imposing certain restrictions on the resale of shares.

In 2024, the Norwegian government imposed heavy restrictions on the possible sale of a property on Svalbard. Svalbard is of unique geopolitical importance due to its strategic location in the Arctic region, and the government was concerned that the property may be sold to an acquirer that will exploit it in a manner that will damage national security interests.

The focus on the Arctic region is further underlined by the ongoing review of the Port of Kirkenes, situated in the north-eastern part of Norway with close proximity to the Northern Sea Route. The review was initiated after it became public that the port was in dialogue with COSCO Shipping, a Chinese state owned enterprise, regarding its establishment in Kirkenes.

Review process timeline

The review process for transactions will differ depending on whether the review is the result of a mandatory FDI filing pursuant to section 10-3, or an ex officio investigation pursuant to section 2-5.

Case handling under section 10-3 concerns businesses subject to mandatory filing. The review period consists of an initial phase of 60 business days from the filing date and an in-depth phase without any formal timeline.

Within the initial 60-day period, commonly referred to as phase 1, the authorities must either approve the transaction or inform the acquirer that the matter will be referred to the King in Council (the government) for a decision. In the subsequent stage, phase 2, there is no definitive timeline for the further review process.

If the authority requests additional information within 50 business days from the receipt of the notification, the 60-business-day deadline is suspended until the requested information is received by the authority.

There is no case handling deadline under section 2-5, which concerns transactions involving businesses that are not subject to a filing obligation in the first place.

Under the current regime, there is no statutory standstill obligation. However, when the 2023 amendments come into force such an obligation will be introduced for transactions subject to mandatory filing. The government also has the power to impose a standstill on a case-by-case basis.

How foreign investors can protect themselves

Under the current FDI regime in Norway, prospective investors should first verify whether the target has received an administrative decision under to section 1-3 of the Security Act to be brought within the scope of the act. If so, it should be verified whether the investment qualifies as the acquisition of a "qualified ownership interest".

Even where there is no mandatory filing obligation, prospective buyers should consider if Norwegian authorities might investigate the transaction ex officio under the general intervention clause in section 2-5.  Prospective buyers should also assess if there is a risk that the transaction may adversely affect the target's ability to serve certain customers post-transaction—for example, due to withdrawal of its security clearance. 
Such a risk assessment will take into account the facts specific to the transaction in question, but will typically involve: verifying if the transaction would require filing if the 2023 amendments to the Security Act were already in force; considering whether the transaction concerns a security-sensitive sector; considering the target's customer list and whether the target holds a supplier security clearance of 'Konfidensiell' (confidential) or higher to serve any of its customers; and considering whether the buyer, its ultimate beneficiary or any companies in the buyer's group have links to high-risk countries.

This outcome of this risk analysis should be used to determine how any FDI aspects of the transaction can best be dealt with in the overall transaction context, including whether risk can be mitigated by reaching out proactively to relevant customers or Norwegian authorities.

Investors are also advised to consider if the transaction timeline accounts for a potential filing process or ex officio review on national security grounds. Depending on the outcome of the filing analysis and the risk assessment outlined above it may be advisable to include Norwegian FDI clearance as a condition precedent to closing.

Transparency about the buyer's ownership structure is advisable during informal contacts with the authorities and in the filing itself to ensure efficient case handling and reduce the risk of information requests that suspend phase 1 or refer the case to phase 2.

Since conditional approval is possible, buyers should consider if potential security concerns can be remedied, including by divesting parts of the target business or terminating sensitive agreements, and the implications of such remedies on the target's value and transaction rationale.

_{White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.}

_{This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.}

_{© 2025 White & Case LLP}