The National Security and Investment Act 2021 (NSIA) became operational on January 4, 2022 and has since become a regular feature of FDI transactions. Certain transactions in 17 sectors are subject to mandatory notification if a target carries on specified activities in that area, but the regime can apply to any transaction, so voluntary filings are also made if an acquirer would like absolute certainty that a transaction will not be retrospectively reviewed. The regime is administered by the Investment Security Unit (ISU), in the Cabinet Office, exercising final decision-making powers.

Unusually, the NSIA is not a true "foreign" direct investment screening mechanism, as it applies equally to UK and foreign investors alike. Indeed, the first conditional decision issued under the NSIA in July 2022 imposed conditions on UK-based investor Epiris in the context of its acquisition of the digital communications provider that supplies radio solutions to UK emergency services, Sepura.

Summary of major changes in 2024

• The Cabinet Office published updated market guidance in May 2024, which explicitly stated that NSIA can apply to outward direct investment and suggests a potential for further scrutiny in situations where a foreign entity or asset being acquired "carries on activities in the UK."
• The government also published a revised NSIA "Section 3 Statement" in May, providing further guidance on how the ISU's power to review and require notification of certain transactions—"call-in powers" —are exercised and the factors taken into account, as well as clarifications on how the Cabinet Office considers cumulative acquisitions and confirming that call-in powers may be exercised more frequently for acquisitions of assets used in connection with activities within the 17 sensitive sectors.
• The government published its first report on the performance of the NSIA (Notifiable Acquisition) (Specification of Qualifying Entities) Regulations 2021 (NARs), which set out the activities within the 17 sensitive sectors, which may bring an entity into scope of mandatory notification.

Who files?

Mandatory notifications are filed by the investor. Voluntary notifications, however, can be filed by any party, including the investor, the seller or the target itself.

Types of deals reviewed

Very little information about NSIA notifications is published. The very fact that a filing has been made is not made public, and only if a transaction is blocked or subject to conditions, will a final order with minimal detail be published. Transactions that are cleared are not publicized, with the total number of notifications only made public in NSIA annual reports.

It is therefore generally not possible to identify if a particular transaction was notified because if it was cleared, no information will be published other than by the merging parties themselves, for example, if they had announced that the deal was subject to NSIA clearance.

There have been six prohibitions since the inception of the regime. Although the regime is technically agnostic as to an investor's origin—requiring notifications even of British acquirers—of the six prohibitions, five concerned investors were from China or Hong Kong.

Two of these prohibitions ordered the unwinding of transactions that had already been concluded before the mandatory filing requirements under the NSIA came into force. This power is a feature of the NSIA, which allows the UK government to "call in" any transaction concluded from November 12, 2020. This retroactive power to call in a transaction for review ordinarily applies for up to five years from the date of the transaction, although this can be reduced to six months if the Secretary of State becomes aware of the transaction, for example, through a voluntary notification.

Conditions have been imposed on 24 transactions since the regime began; of these, 12 were imposed in 2024 alone.

In terms of the sensitive sectors subject to conditional decisions, defense and military and dual-use transactions are the most prominent. This is no doubt a function of the particular sensitivities of those sectors, but also the breadth of deals captured with defense, in particular, capturing a wide range of targets, including those with incidental access to military sites via cleaning or catering contracts, for example.

Conditions vary by sector but focused on behavioral rather than structural commitments. These have included: requirements to implement enhanced security controls to protect sensitive information and technology from unauthorized access; requirements that certain key personnel or board members are pre-approved by UK government authorities; restrictions on the sharing of certain target information, including with the investor; and commitments to maintain certain business activities in the UK.

Again, Chinese investors feature prominently in relation to conditional clearances. However, conditions have also been imposed in transactions with UAE, UK, US and European investors.

Scope of the review

The scope of the review under the NSIA is three-pronged.

The ISU assesses "control risk"—the level of control that will be asserted by the prospective investor. Less control merits less concern from a national security perspective, particularly where an investor is seeking to take a non-controlling stake. A mandatory filing can be triggered with a 25 percent equity or voting stake, so the level of the investment will affect the determination of the control risk as will any rights attached to minority shareholdings.

The ISU also examines "target risk"—the extent to which the target is being used, or could be used, in a way that raises a risk to UK national security. This may involve considerations such as proximity to sensitive sites as well as the specific nature of the target's activities. Ultimately, however, any target falling within the defined sensitive sectors will raise target risk considerations. Where targets fall within multiple sensitive sectors, this risk may be considered enhanced.

Finally, "acquirer risk" is assessed. This entails a review of the acquirer including the ultimate controller. Specifically, the acquirer risk assessment will consider whether the acquirer "has characteristics that suggest there is, or may be, a risk to national security from the acquirer having control of the target." These characteristics include associations with states or organizations that may be considered hostile to the UK, although this concept is undefined. Helpfully, previous guidance has made clear that a history of passive or long-term investments may indicate low or no acquirer risk.

Review process timeline

The timeline under the NSIA runs from the date that the notifying party receives confirmation that the notification is accepted as complete. Best practice guidance stipulates that the ISU will seek to do this within five working days, but, in practice, protracted delays are becoming increasingly common.

Once this confirmation is received, the review process is divided into two parts: a 30-working-day review period that applies to all notified transactions; and a 30-working-day assessment period, which applies to any transactions that are subject to a "call-in notice," indicating that they will be subject to more detailed scrutiny. This can be extended by another 45 working days if required. Any further extensions beyond this time period require the investor's written consent.

How foreign investors can protect themselves

It is, of course, crucial to understand whether or not a transaction requires a mandatory notification. However, given the ability of the government to call in any transaction, it is sensible for acquirers to assess the risks associated with any transaction if the target's activities may in any way be considered sensitive. As this analysis is all target-focused, engaging due diligence of prospective targets early on for these purposes is very important and will depend to a large extent on good engagement with the seller. Where the target is hostile, then the ability for the acquirer to assess the NSIA risks is much harder.

So far, the focus in terms of probing transactions, and imposing conditions, has been on information ring-fencing and securing continuity of supply to critical services in the UK. Therefore, it is important to have a clear narrative in place around the control, information-sharing and intentions that an investor has for a sensitive target in the UK.

In terms of transaction certainty, investors may want to consider judicious use of the voluntary notification option. For example, while mandatory notifications are only required with respect to share sales, asset deals that would otherwise trigger if structured as a share deal would be good candidates for voluntary pre-clearance. This also eliminates the prospect of a retrospective call-in after the transaction has closed.

For transactions that are subject to call-in review, it is notable that often there will be limited, if any, engagement with the ISU. The ISU has the power to issue information and attendance notices but will not necessarily do so. Nonetheless, an investor always has the option to submit further information for the Secretary of State's attention that must be taken into account in their decision under the provisions of the NSIA, and selective use of this option can help to allay potential concerns.

It is also important to keep in mind, however, that the vast majority of transactions will be cleared without a "call-in" review. In 2023, of the 847 reviewed by the ISU, less than 5 percent (37) of notified acquisitions were called in.

_{White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.}

_{This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.}

_{© 2025 White & Case LLP}