What is the National Security and Investment Act 2021?

The Act enables the Government to scrutinise and intervene in any acquisitions meeting certain criteria. The Act also establishes an operational unit (currently within the Cabinet Office) called the Investment Security Unit (“ISU”), which manages and administers the Act’s notification and screening regime. Under the current regime, final decisions are made by the Chancellor.

There are certain “trigger events” to be aware of. Each of these involve a person (natural or legal – e.g. a company) acquiring rights or interests conferring control over:

• a qualifying entity; or
• a qualifying asset.

Qualifying entities include (but are not limited to) UK companies and limited liability partnerships.

This can include non-UK registered entities, if those entities carry out certain operations within the UK. The Government have released a helpful note on these types of scenarios. 

Qualifying assets include (but are not limited to): (i) land, (ii) tangible moveable property; or (iii) ideas, information or techniques which have industrial, commercial or other economic value in the UK (including but not limited to trade secrets, databases, and designs).

The following are instances of trigger events:

• the acquirer’s percentage of shares or voting rights in the qualifying entity increasing to reach more than 25%, or more than 50%, or at least 75%; or
• voting rights in the qualifying entity that enable the acquirer to secure or prevent the passage of any class of resolution governing the qualifying entity; or
• the acquirer being able to exercise material influence over the qualifying entity’s policy.

“Material influence” is not clearly defined by the Act, but the Government have indicated that they will rely on guidance issued by the Competition and Markets Authority on how the same term is viewed for competition law purposes and under the Enterprise Act 2002.

It is also worth noting that an indirect acquisition (where a person acquires indirect control over a qualifying entity through an unbroken chain of majority stakes) can be a trigger event.

• either simply use the qualifying asset or use it more than before it was acquired; or
• either control how the asset is used or exercise greater control on it than before it was acquired.

The “investment” part of the Act’s title is potentially a little misleading. Think about it this way; if you were to sell your company then you would likely be selling 100% of the company’s shares to a third party. This would mean that the buyer would be acquiring “more than 25%”, “more than 50%”, and “at least 75%” of the shares (and voting rights), so a sale of a company is very likely to be a “trigger event”.

A sale / transfer of some, but not all, shares can also be a “trigger event” if the relevant thresholds are passed. Note this could potentially include secondary share sales in connection with an investment round.

As noted above, the Act can also apply to asset transactions. Rules around these can be complex so we would always advise taking legal advice where there are any uncertainties (and particularly if the asset being sold is used in one of the sensitive sectors named below).

Lenders taking security over shares should also pay careful attention to the terms of the Act, as certain forms of security can come with control and/or voting rights (either now or in the future) and so result in a trigger event. Although it is expected that most commercial lending will not be impacted by the Act.

If your transaction involves a trigger event, you should carefully consider whether you should make either a mandatory or voluntary notification to the ISU.

If your transaction does not involve a trigger event you do not need to make a notification. However, the option is open to you to make a voluntary notification if there is any uncertainty and you wish to confirm the transaction is not caught by the Act (though this is unlikely to be an efficient use of resources unless there is real potential for a national security concern).

Any notification ought to be made prior to the acquirer gaining control. Notifications are made online via a bespoke portal managed by the ISU.

The primary obligation to submit a notification sits with the acquiror / investor, but in practice the parties to a transaction will need to work together as the notification process will require in-depth information about the business and operations of the qualifying entity. It is also in all parties interests to ensure that a transaction is capable of being legally completed!

Where:

1. a trigger event occurs; and
2. the qualifying entity being acquired is involved in any of the sectors in the table below,

then a mandatory notification must be made by the acquirer. These sectors are fully described in The National Security and Investment Act 2021 (Notifiable Acquisition) (Specification of Qualifying Entities) Regulations 2021. The Government website also has guidance on identifying whether a qualifying entity comes under any of the below sectors:

If you believe your business operates in or adjacent to any of these sectors we would strongly recommend familiarising yourself with the full definitions and guidance. The Regulations mentioned above define some of the sectors fairly widely which requires careful assessment of whether a particular business is captured, whereas some others are quite narrowly defined meaning it can be more obvious whether or not a business is caught within scope.

An acquisition of a qualifying asset is not subject to mandatory notification at the moment, however, a voluntary notification can be made.

To mitigate risk, the parties to a transaction involving a trigger event may choose to voluntarily notify the ISU. Voluntary notifications are uncommon in practice, but can be useful where there is any uncertainty as to whether a qualifying entity operates in one of the above sectors, operates in a  field which is adjacent to any of the relevant sectors, or where there is a real possibility of national security concern, as the application can eliminate doubt about whether a transaction is caught by the Act and could later be called-in by the Government.

There are no exceptions or exemptions within the Act for UK-based acquirors / investors, regardless of how well known or reputable they may be, and regardless of whether those acquirors / investors have previously been involved in transactions which have been cleared under the Act.

This is something which has been raised with the Government by the industry (including by some of our own lawyers) in response to the Government calls for feedback and evidence on the operation of the Act. However, in the “National Security and Investment Act 2021: Call for Evidence Response”, updated 18 April 2024 (available here: National Security and Investment Act 2021: Call for Evidence Response – GOV.UK), the Government stated: “Some respondents also called for a fast track process for certain types of acquirer, for example those who have already had a prior transaction cleared through the NSI system. The Government wants transactions that are unlikely to create national security concerns to face as little delay or uncertainty from the NSI system as possible, but the Government is not considering such a fast track process… transactions need to be assessed on a case by case basis.”

The Act doesn’t set out any exemptions for low value transactions. If there is a trigger event and you are operating in one of the 17 specified sectors, mandatory notification will be required (and notification may be needed, or the call-in power available to the Government, in other situations as alluded to in this note).

Equally, where one of the 17 specified sectors does not apply, the Government can still opt to call-in a transaction for assessment if it involved a trigger event and they have any reason to suspect national security concerns, even where the transaction might be very low value.

Potentially, yes.

It’s unlikely that a University or University Tech Transfer Office would take a significant enough equity stake in a spin-out company to qualify as a trigger event, so in the vast majority of cases we would not expect the equity side of the spin-out process to be impacted by the Act.

However, if / when the spin-out company then licences IP from the University, this licence could result in an “acquiror” (the spin-out) gaining a new right to control or otherwise use a qualifying asset (the IP). As noted above, asset transactions are not subject to mandatory notification, but if the IP in question would fit within one of the 17 sensitive sectors and there is any suggestion of national security risk (e.g. a shareholder / investor in the spin-out comes from a high-risk jurisdiction) then it would likely be sensible to submit a voluntary notification as there would be a risk that Government could call-in the transaction for assessment.

The Government have released some specific guidance notes for the higher education and research-intensive sectors.

You wait. If you have identified a notifiable transaction, and you have made a valid notification, the ISU will review your notice as soon as reasonably practicable, and it will be either: (a) accepted, or (b) rejected.

If the notification is accepted, the Secretary of State must decide within 30 working days to either: (a) clear the notified transaction, or (b) call in the transaction for a full national security assessment.

If the notified transaction is cleared, you are able to proceed with the related transaction.

The process can take longer if the ISU have queries or seek clarification, so it is advisable to aim for the initial notification to include all information the ISU may need. Suitably experienced advisors can help with this process.

If the transaction is called in for assessment then timelines are likely to be significantly longer.

As mentioned throughout this note, the Government has wide-ranging powers to call-in any transaction involving a trigger event for assessment if it believes there is any element of national security concern. This power can be exercised at any time up to six months from when the Government first become aware of a transaction – there is also an ultimate long-stop date of up to five years from completion of the transaction for a transaction which would not have been subject to mandatory notification, but there is no such long-stop for a transaction which would have been subject to mandatory notification.

If the transaction was subject to mandatory notification but no clearance was obtained, the acquisition will be automatically void (i.e. legally it never happened and any monies should be repaid) – note that this is the case regardless of whether or not the transaction is later called-in for assessment. It would likely be difficult to sell or obtain further investment in a business which has breached the terms of the Act in this way. There are circumstances in which a void transaction may be retrospectively validated by the Government, but this is not something we would suggest relying on.

The acquirer / investor could also be subject to civil and criminal offences, sanctions, and enforcements (which can include substantial fines of £10million+ and/or imprisonment for up to 5 years, as well as the implementation of restrictions on the acquired business).

Fines, sanctions and enforcement action can also be imposed where a transaction was not subject to mandatory notification, but has been deemed as a potential national security risk by the Government and called-in for assessment.

Research and assistance for this page was provided by Charles Oliver, Paralegal in our Corporate team based in our Bristol office.

Our team have worked on many transactions involving notifications to the ISU and successfully obtained clearances under the Act.

If you think your transaction may require notification under the Act and/or this article has raised any questions, please do contact Scott Preece, Partner and investment specialist, or another member of our Corporate team.