National Security and Investment Act (NSIA) and the impact on Corporates – A trap for the unwary with serious consequences

The consequences of missing the mandatory NSIA regime can be serious. If a notifiable event completes without prior clearance, it is void from a UK perspective. The acquirer may also face civil penalties and criminal liability. Where the acquirer is a corporate entity, this risk may extend to its group and directors. 

Professional advisors involved in advising on corporate related events may also face charges of aiding and abetting a criminal offence and issues related to proceeds of crime.  Although no criminal or civil enforcement action has been taken to date, the possibility of applying for retrospective clearance to validate a transaction that is otherwise void, will not remove the potential exposure to the civil and criminal risks even if clearance is granted retrospectively.

Misconceptions and Realities 

One of the biggest misconceptions about the NSIA regime is that it only applies where there is an obvious UK national security concern. This is not the right test. 

When the NSIA regime was introduced, it was anticipated that about a third of all mainstream corporate transactions would be affected.  In practice, the proportion appears to be higher – around 40% - because of the breadth of the NSIA regime.  The scope of corporate related events and activities caught are far wider than most would expect. It is not limited to traditional share sales and acquisitions. It can also apply to routine changes in share ownership or voting rights, internal group arrangements, reorganisations, trusts, trustee changes and estate administration on death. 

Despite this broad scope, the total number of NSIA notifications being made is significantly lower than expected.  This discrepancy suggests that many corporate related events which are caught by the NSIA regime are not being notified and cleared as required, leaving them void and exposing the parties to legal risks, probably without them even realising it. Many professional advisors fail to understand the breadth and scope of the NSIA regime. 

It is important to separate the notification question from the national security assessment. Approximately 95% of all corporate related events caught by the mandatory NSIA regime are not expected to raise UK national security concerns. UK national security concerns are only relevant to whether clearance will be granted, not to whether the NSIA regime applies in the first place. The regime deliberately casts a wide net to help identify the relatively small number of transactions that may raise genuine national security concerns. The result is that many routine or low-risk matters may still need to be notified and cleared before they can proceed. 

Scope and Implications 

Two elements are required for the mandatory NSIA regime to apply: 

• a trigger event; and
• an activity falling within any one or more of 17 NSIA Sectors.

A trigger event is broader than many might expect and extends far wider than normal tests for change of control. A trigger event can arise where voting rights or equity ownership change so that a person crosses one of the key NSIA thresholds: more than 25%, more than 50% or 75% or more. It can also arise where there is a change in who can pass or block any class of resolution or where there is an effective change of control higher up a group structure.   

The mandatory NSIA regime can apply to direct and indirect changes. It can also apply even where ultimate control has not changed but there is a change in intermediate ownership or voting rights in a group structure. This is far wider than the normally understood meaning of change of control. In practical terms, any event that changes the position on equity ownership or voting percentages can be a trigger event for NSIA purposes.

The second element is whether the relevant corporate or corporate group below the trigger event is carrying out activities connected with the UK in one or more of 17 specified NSIA sectors. Some of the sectors are obvious, such as defence, but others are much broader than might be expected.  Also, even obvious sectors such as defence are wider than would be expected and catch supplies or relationships which are not obviously defence related and defence sub-contractors at any level.

The mandatory NSIA regime may capture activities that may not appear obviously sensitive. Corporates that own or exploit software written in low level code or that develop or use artificial intelligence systems may fall within scope. The advanced materials sector is also broader than many expect, including components, parts or products containing rare earth magnets, as well as certified components or parts. 

Other sectors can also have a wide practical reach. Live streaming or transmitting data over public communications networks may fall within the data infrastructure sector regardless of the customer’s identity.  Direct contracts with most parts of UK central government will usually bring the activities within scope. The same may apply to any sub-contractors where the end customer is UK central government. This can have unexpected consequences. For example, companies on Crown Commercial Service framework contracts, such as G-Cloud, may be subject to NSIA screening even if they are not directly selling to UK central government. 

The practical point is that seemingly minor and non-security related activities can still trigger the need for mandatory NSIA clearance if there is a NSIA trigger event. 

Corporate Impact

The regime can apply to a wide range of corporate events, not just share sales and acquisitions. Potential trigger events include share buybacks, share allotments, LLP member admissions or retirements, disenfranchisement, the exercise of share options, group reorganisations and the exercise of swamping rights.  

This broad scope can complicate private equity or corporate transactions, where changes in voting rights or equity ownership percentages may require mandatory NSIA clearance before they can take effect. It can also create issues on an exit or sale process if previous events affecting the target group were not cleared and are later identified during due diligence.   Group reorganisations are another common area of risk as they may require clearance even where ultimate ownership and control remain unchanged.

Where there is a trigger event, the corporate group below that trigger event must be screened for NSIA sector activity. This can involve asking detailed questions to establish whether any part of the corporate group carries out activities within the relevant NSIA sectors.

The NSIA regime also has significant international reach. Unlike many equivalent regimes in other parts of the world, the NSIA applies regardless of the acquirer's identity, ownership or the location of the target group. It may therefore affect corporate related events occurring entirely outside the UK where the trigger event occurs in a foreign corporate group. 

In most cases, there are no minimum size or value thresholds. Low value and non-mainstream activities can still require NSIA clearance.

Voluntary NSIA Regime

Running alongside the mandatory NSIA regime is a voluntary NSIA regime which allows notification and clearance of certain types of events relating to qualifying assets.  Again, this is very wide in its scope. 

The term “qualifying assets” has a wide meaning and in practice will catch assets such as land, intellectual property, plant, equipment and components as well as equity interests falling outside of the mandatory NSIA regime.  Trigger events broadly mirror those under the mandatory NSIA regime but also include anyone new obtaining use or control of a qualifying asset or an existing user gaining increased use or control of that asset. 

Although the voluntary regime is generally used only where there is an actual or potential impact on UK national security, it can be an important way to manage the risk of the UK Government calling in an event for review for up to 5 years after the later of completion and the event becoming public. This may be particularly relevant where the event involves participants from, or controlled by entities based in, jurisdictions regarded as higher risk.

Government Powers

There are no real limits on the scope of an order that the UK Government can make if it finds that an event within the scope of the NSIA regime presents an actual or potential risk to UK national security.  It can impose conditions, often drawing on conditions used in previous cases, or, in more serious cases, prohibit the event from proceeding or require arrangements that have already occurred to be unwound.

Future Changes

The UK Government intends to address some of the anomalies in the mandatory NSIA regime, including removing certain corporate events and activities from scope. However, the proposed changes would also bring new activities within the regime and increase the number of specified NSIA sectors from 17 to 19. The overall picture is therefore one of refinement, not relaxation. While some issues may fall away, the mandatory NSIA regime is likely to expand in other areas, and the changes are not expected to be retrospective.

Key Takeaways 

NSIA should be considered early in any transaction, reorganisation, trust arrangement, estate administration step or other ownership change, i.e. any event which will change interests in equity held or associated voting rights. The assessment involves two stages:

• identifying whether there is a relevant trigger event; and
• checking whether the corporate group below that trigger event carries out activities in one or more of the NSIA sectors. 

This screening process can involve detailed factual questions and careful analysis of the NSIA sector definitions. There are no real shortcuts.

If both conditions are met, NSIA clearance will be required before the event can proceed. 

This makes early, experienced advice important. Advisors need to be able to identify whether a trigger event arises and, where it does, carry out a focused screening exercise to determine whether NSIA sector activity is present below that trigger event.

Failing to identify a clearance requirement can have serious consequences, including delay, transaction uncertainty, the risk that the event does not take legal effect in the UK and potential civil or criminal sanctions. Considering NSIA at the outset helps manage timing, risk allocation and completion planning.

How can IM help?

Our team has extensive experience helping clients navigate the NSIA regime, both mandatory and voluntary. We can work with you at an early stage to identify whether a trigger event may arise, carry out focused sector screening and manage any notification or clearance process if required.  We can also work with you to assess whether a voluntary NSIA notification would be prudent if the mandatory NSIA regime does not apply or assess whether a previous event should have been notified and cleared under the mandatory NSIA regime and therefore requires a retrospective notification seeking clearance. 

Early advice can help avoid unexpected delays, transaction uncertainty, the risk that the event is void and potential sanctions. If you are planning a transaction, reorganisation, trust arrangement, estate administration step or other ownership change, please contact us so we can help you assess the position and manage NSIA risk before it becomes an issue.