The National Security and Investment Act 2021 is now on the statute book and is to come into effect on 4 January 2022. A draft statutory instrument was issued on 20 July 2021 specifying the sectors transactions in which will be subject to mandatory notification under the new regime and providing further guidance on the relevant activities that will be caught by the Act.
The National Security and Investment Act 2021 (the “Act”) will strengthen the UK Government’s regulatory powers with regard to investment in UK companies. The Act, which received royal assent on 29 April 2021, will enable the Secretary of State for Business, Energy and Industrial Strategy (the “SoS”) to scrutinise and intervene in certain investments to protect national security. The regime that the Act establishes is to come into effect on 4 January 2022. Upon commencement however, the regime will also enable the SoS to ‘call in’ relevant transactions that have completed since 12 November 2020 as well as transactions that have not yet completed.
The regime which the Act will establish includes:
- the SoS’s new call-in powers to assess and intervene in transactions involving entities operating in the UK or certain UK assets where it is considered that national security could be affected;
- a hybrid notification process: a mandatory notification (and pre-approval) requirement for certain investments and acquisitions involving entities operating in particular sectors of the UK economy where it is considered that national security could be affected, and a voluntary notification option; and
- the creation of a new operational unit within the Department for Business, Energy and Industrial Strategy (“BEIS”) - the Investment and Security Unit (the “ISU”) - responsible for identifying, addressing and mitigating national security risks to the UK arising when a person gains control of a relevant asset or entity as set out in the Act.
Much of the commentary surrounding the Act has been with regard to foreign investment, but the Act does not distinguish between foreign and domestic investment. Therefore any investment which is deemed to be a national security risk, irrespective of who is making the investment, will be caught by the new regime.
The Act will replace the national security provisions of the Enterprise Act 2002 (which will fall away when the Act comes into effect).
The new regime
The SoS will have the power to call in a transaction for review where the SoS reasonably suspects that: (a) a trigger event of any of the types referred to below has taken place in relation to a qualifying entity or qualifying asset, and the event has given rise to or may give rise to a risk to national security, or (b) arrangements are in progress or contemplation which, if carried into effect, will result in a trigger event taking place in relation to a qualifying entity or qualifying asset, and the event may give rise to a risk to national security.
The Act does not define national security, and so it has been left to the ISU to interpret its meaning. Under a statement of practice, the ISU has said it will have regard to the three following factors:
- the target risk – being the nature and activities of the target business or asset;
- the trigger event risk – being the level of influence acquired; and
- the acquirer risk – being the identity and affiliations of the buyer/investor.
The time-limit for this call-in process is five years after completion of the relevant transaction or, if earlier, six months from when the SoS becomes aware of the transaction. The Act is retroactive to the extent that any transaction which has completed from the date the bill was introduced to Parliament (12 November 2020) up until the commencement date of the legislation (confirmed to be the 4 January 2022) may be called in by the SoS up to six months after the commencement date of the legislation. The Act does not grant the SoS call-in powers for any deals which completed prior to 12 November 2020.
The SoS may make two types of order under the Act:
The SoS may, during the assessment period in relation to a call-in notice, make an order for the purposes of preventing or reversing pre-emptive action, or mitigating its effects.
Before the end of an assessment period, the SoS may make a final order (or must alternatively give a final notification that no further action in relation to the call-in notice will be made). A final order will be made when the SoS is satisfied that a trigger event (listed below) has occurred and there is a risk to national security that would arise.
Both interim and final orders may contain provisions that prevent certain actions, prescribe certain actions or appoint a relevant supervisor to review an entity’s actions.
The Notification Regime
The primary impact of the Act for most investors will be the introduction of a hybrid system of notification with both mandatory notification and voluntary notification regimes. Notifications will need to be made in a prescribed form via an online portal.
The mandatory notification regime will apply to the acquisition of shares in companies exceeding certain thresholds, and will not cover other asset purchases or commercial activities (e.g. the granting of intellectual property licences or rights in land). Such asset transactions, which could potentially be ‘called in’, will only be subject to the voluntary notification regime.
Mandatory Notification Regime
An acquisition will need to be notified where a person gains control, on certain trigger events, of a qualifying entity carrying on activities in the UK. A draft statutory instrument issued on 20 July 2021 (the "Regulations") set out the 'qualifying activities' of such qualifying entities which will determine whether investments in those entities comes within the scope of the Act and the notification regime
A “qualifying entity” means any entity, whether or not a legal person, that is not an individual, and includes a company, a limited liability partnership, any other body corporate, a partnership, an unincorporated association and a trust. An entity which is formed or recognised under the law of a country or territory outside the UK is a “qualifying entity” only if it (a) carries on activities in the UK, or (b) supplies goods or services to persons in the United Kingdom.
The government has noted that certain sensitive sectors of the economy are particularly susceptible to threats to national security. The Regulations specify 17 key sectors to which the mandatory notification regime will apply, as follows:
- Advanced Materials;
- Advanced Robotics;
- Artificial Intelligence;
- Civil Nuclear;
- Computing Hardware;
- Critical Suppliers to Government;
- Cryptographic Authentications;
- Data Infrastructure;
- Military and Dual-Use;
- Quantum Technologies;
- Satellite and Space Technologies;
- Critical Suppliers to the Emergency Services;
- Synthetic Biology (which would cover many life sciences companies); and
With regards to "Synthetic Biology", the aspect of the Act of most relevance to the life sciences sector, this is defined as including (but not being limited to):
- the design and engineering of biological based parts of enzymes, genetic circuits, cells, novel devices and systems;
- re-designing existing natural biological systems;
- using microbes to template materials;
- cell-free systems;
- gene editing and gene therapy; and
- the use of DNA for data storage, encryption and bio-enabled computing.
The above definition is broad and vague and the list of exceptions to the definition are similarly broad and vague which does not provide much comfort to entities in this sector considering whether their activities would constitute a qualifying activity within the remit of the Act.
A mandatory notification to BEIS will be required where a transaction involves both a qualifying entity carrying on activities in the UK in one of those 17 key sectors and a trigger event comprising the acquisition of:
- more than 25% of the shares or votes in the entity;
- more than 50% of the shares or votes in the entity;
- more than 75% or more of the shares or votes in the entity; or
- voting rights in the entity that enable the investor to prevent the passage of any class of resolution governing the entity.
Any acquisition which involves one of the trigger events listed 1 - 4 above and falls under this mandatory notification regime will require clearance from the SoS prior to completion, irrespective of the size of the target or its UK business. Not only will new investors in a business be caught under the Act but current shareholders investing further money could be also caught.
Voluntary notification regime
A voluntary notification may be made where a transaction involves one of the trigger events referred to above in relation to an entity not active in one of the 17 key sectors, or involves a trigger event comprising the acquisition of:
- a right or interest that enables the person materially to influence the policy of the entity (which could potentially include a right to approve certain reserved matters) provided they did not hold such a right prior to the acquisition; or
- a right or interest in, or in relation to, an asset as a result of which the person is able to:
- use the asset, or use it to a greater extent than prior to the acquisition; or
- direct or control how the asset is used, or direct or control how the asset is used to a greater extent than prior to the acquisition.
Given the broad scope of the Act (and in particular the call-in powers referred to above), it is considered likely that a high volume of transactions will be voluntarily notified to BEIS for the purposes of mitigating the risk of the transaction subsequently being called in.
The legal obligation of notifying the ISU falls upon the investor/acquirer rather than the target entity or seller. Any investor/acquirer contemplating a transaction involving trigger event of any of the types referred to above should therefore obtain early legal advice on whether the transaction should be treated as a notifiable acquisition and/or the risk of the particular transaction being called in. In cases of doubt as to whether a mandatory notification or voluntary notification is appropriate, it may be appropriate to contact the ISU informally at any early stage of the transaction. This will likely involve some dialogue with the investee entity to assess whether the nature of the business of the entity is such as to bring it within the scope of the mandatory notification regime and/or to raise any potential national security concerns.
Sanctions for non-compliance
An investor/acquirer which completes a transaction which falls within the mandatory notification regime without the approval of the SoS, without reasonable excuse, commits an offence. If an offence under this Act is committed by a body with the consent or connivance of an officer of the body, or due to any neglect on the part of such an officer, the officer (who may include a de facto or shadow director) is also guilty of the offence. This offence may result in up to five years’ imprisonment. Alternatively, the SoS may impose a monetary penalty of up to 5% of the total worldwide turnover of the investing/acquiring business or £10 million (whichever is higher) These sanctions also extend to non-compliance with any orders made under the Act.
There are further offences of failing to comply with an information or attendance notice, supplying false information to the SoS, intentionally or recklessly destroying information relating to the transaction and intentionally obstructing or delaying the making of a copy of information provided in response to an information notice. Relevant sanctions for committing these offences include up to two years’ imprisonment or, alternatively, a monetary penalty of £30,000.
More concerning, perhaps, is that any transaction which falls under the mandatory notification regime and is completed without the approval of the SoS is void. The SoS must, however, within 6 months of becoming aware of the notifiable acquisition, either call in the transaction or give a validation notice in relation to the acquisition. The effect of the validation notice is that the notifiable acquisition to which it relates is to be treated as having been completed with the approval of the SoS (and, accordingly, is no longer void). Any person materially affected by the fact that a notifiable acquisition is void, may also apply to the SoS for a validation notice in relation to the acquisition.
The notification process
The notification process will begin with either a mandatory or voluntary notification. The ISU then has to provide a decision as soon as reasonably practicable as to whether they accept or reject the notice (including rejection on the basis that the notice does not contain sufficient information to allow the SoS to decide whether to give a call-in notice in relation to the proposed notifiable acquisition). If the notice is accepted, the SoS must, as soon as practicable, notify the person who gave the notice, and, within 30 working days from the date on which the SoS gives such notice, issue a call-in notice in relation to the relevant transaction, or confirm that no further action will be taken under the Act in relation to the transaction.
If a call-in notice is issued, this will initiate an assessment period of 30 working days. The SoS can extend this assessment period by a further 45 working days if required (and potentially for a further period that may be agreed with the acquirer). Therefore the ISU/SoS can take up to 105 working days to approve the transaction. It should be noted that, while unlikely, the SoS can stop the clock throughout the period by requesting further information from the parties.
The Government has confirmed in previously issued consultation papers that the majority of notifications are intended to be decided within the initial 30 day period.
It is therefore paramount that this review period is factored into the transaction timetable if either a mandatory or voluntary notification is to be made. It could be a good idea to file a voluntary notification if any of the parties are in doubt as to whether the transaction falls within the voluntary notification regime. The new regime has some similarities to the US regime supervised by the Committee of Foreign Investment in the United States (CFIUS), and it has been suggested, on the basis of the experience of transactions governed by CFIUS, that the deals susceptible to ‘derailing’ are often those where the parties have not identified the need to make a notification during the early stages of the transaction.
Implications for transactions
Broadly speaking, the Act will have three main consequences for transactions involving investment in entities operating in the UK which are subject to the Act’s regime, all of which are linked to the timelines for transactions.
The Act will increase the uncertainty and execution risk associated with such transactions, as both the viability of the transaction and the deal timetable will be directly affected by the SoS’s / ISU’s involvement.
Investors are therefore likely to need to factor in such uncertainty into the drafting of the legal documentation, and include provisions that mitigate the risk that the transaction is called in and/or blocked. Until we see some examples of how the notifications will be reviewed in practice, it will be difficult for all parties to know what the outcome of a notification is likely to be.
Linked to the above, due to the fact that the Act represents a significant extension of the current UK regulatory regime in relation to investments in UK entities, there is likely to be a large number of speculative notifications made, which will in turn affect the ISU’s ability to process such notifications.
The UK Government anticipates that approximately 1,800 such notifications will be made to the ISU each year. However, particularly in the case of some sectors where the definitions of the relevant sector are relatively open to debate (for example, the definition of synthetic biology prompted considerable debate in the life sciences sector during consultation), it is widely anticipated that a much greater number of notifications will be made than the Government is expecting.
Particularly for early stage companies, the requirement for transactions to be closed in a prompt manner is often critical. The potential for governmental review and even intervention in such transactions is inherently detrimental to the ability of some companies and their investors/acquirers to close transactions quickly. The Act will change the UK investment/M&A landscape, particularly in the 17 key sectors the Government has identified. Investors will now need to conduct thorough legal and regulatory due diligence on the nature and extent of the target’s UK operations to see whether the proposed transaction could be a notifiable acquisition and/or give rise to any potential national security concerns for the purposes of the Act.
The UK Government has consistently played down the likelihood that it will need to use its new powers under the Act to restrict any investment. However, both sides of a deal, acquiror and seller/investor and investee, need to be aware that a mandatory filing may be required or a voluntary filing may be advisable. It is therefore important for investors/acquirers of a business of any size with UK operations in sensitive sectors to be aware of the Act and to factor in any notification that might have to be made early within a transaction.
The ISU has allowed businesses to contact them informally for guidance. Many businesses are rightly wary of the Act delaying the completion of deals but BEIS has continually said that they are willing to engage with businesses to combat uncertainty. However, the ability of BEIS to deal with what may be a flood of speculative notifications remains to be seen.