🇬🇧How National Security Review works

General concept and objectives

National Security Review is a process of assessing foreign investments by government authorities for potential threats to national security. In the modern world, many developed countries have significantly strengthened control over foreign capital investments, with particular attention to investments from Russia and China.

The main objective of such reviews is to ensure protection of strategic economic sectors and critical infrastructure from undesirable foreign influence. These mechanisms are designed to prevent acquisition of important assets by foreigners in cases where this may create national security risks. For the investor the practical output of the process is a legal status: a cleared transaction may lawfully close and cannot normally be reopened on the same facts, while an uncleared one carries the risk of prohibition, conditions or forced unwinding.

Key aspects of the review process

• identification of UBOs and funding sources, including verification of links to sanctioned persons
• assessment of potential access to critical technologies, intellectual property and data (including establishing the location of data processing and persons having access to it — especially programmers);
• analysis of the possibility of using acquired assets for military or intelligence purposes
• verification of the transaction's impact on market concentration and economic security of the country
• assessment of foreign state involvement in management of the investor company

Historically, these mechanisms were significantly strengthened after 2014 due to geopolitical changes, and then received additional development after 2022. The result of a review may be full approval of the transaction, partial approval with certain conditions, blocking, or forced divestment of already acquired assets.

The 2024–2026 wave has raised the bar. The United States launched its Outbound Investment Security Program (informally the "reverse CFIUS") on 2 January 2025 and cemented the course with the America First Investment Policy memorandum. In June 2026 the EU adopted a new Regulation (EU) 2026/1386 to replace 2019/452, Canada tightened the Investment Canada Act, and Switzerland for the first time in its history adopted its own screening law. The common logic: the perimeter of control is shifting from classic M&A toward deals involving technology, data and critical raw materials.

What exactly is tested: investor, asset, stake and rights

Every screening regime, whatever its procedural design, asks the same four questions. They should be answered before signing, because together they determine whether a filing is mandatory, merely available, or unnecessary.

Who invests. The regulator looks through the acquisition vehicle to the ultimate ownership and funding chain: individuals, states, state-linked funds, sanctioned persons. The test is control and influence over the investor, not the citizenship shown on a passport. A trustee holds legal title for beneficiaries, a nominee shareholder holds it for a principal, and a second passport changes a travel status — none of them changes the ownership, control and funding facts that are tested, and concealing them converts a jurisdictional question into an enforcement problem. The only origin-based exemption in the reference regimes — the US excepted investor — is itself a look-through test of the whole chain, not a passport check. The UK regime does not even distinguish by nationality: any acquirer, including a British one, can trigger a mandatory filing, and the investor's origin affects the risk assessment rather than the duty to file.

What is acquired. Sector and asset type do most of the work: defence and dual-use production, critical infrastructure, semiconductors, AI and quantum technologies, sensitive personal data, and — a separate US category — real estate near military installations. The same money buying a logistics warehouse and a chip-design house faces entirely different filters.

How much is acquired. Formal thresholds are counted in voting rights, not economics: 25/50/75% in the UK, 10/20/25% in Germany, "substantial interest" of 25% in the US mandatory-declaration test. Thresholds are measured through the whole indirect chain — votes held via intermediate holdcos, and in some regimes votes of persons acting in concert, are aggregated.

What rights come with the stake. This is where minority deals are won or lost. Board membership or observer seats, the right to nominate a director, veto rights over strategic decisions, and access to non-public technical information can each bring a below-threshold investment into scope — in the US through the covered investment definition, in Germany through the doctrine of atypical control acquisition, in the UK through "material influence" as a call-in ground. Conversely, giving up those rights is often the cheapest way to keep a genuinely financial investment outside the regime.

The table below compresses the mechanics: a deal fact, the legal test it hits, and the consequence. It is a routing map, not a substitute for checking the current text of each regime before a transaction.

The pattern to retain: percentages decide whether a mandatory filing exists; rights decide whether the regulator has jurisdiction at all — and jurisdiction without a mandatory filing is exactly the zone where call-in and post-closing risk lives.

USA: Committee on Foreign Investment (CFIUS)

In the USA, the key body for reviewing foreign investments is the Committee on Foreign Investment (CFIUS), which blocks transactions potentially threatening national security. CFIUS has broad powers to review and potentially block transactions, especially in the technology sector.

Types of transactions subject to review

• acquisition of control in US business by a foreign person
• investments in critical infrastructure
• investments in companies working with sensitive personal data
• acquisition of real estate near military facilities and sensitive infrastructure
• investments in critical technologies

Mandatory notification is required in cases of

Timing is part of the rule: a mandatory declaration is submitted no later than 30 days before the completion date (31 CFR § 800.401(g)), so a closing calendar that leaves less than a month between signing and completion is already non-compliant. The rule also lists its own exceptions in § 800.401(e): a covered control transaction by an excepted investor; an indirect investment held through an entity operating under a US facility security clearance; an investment through a fund whose general partner is not a foreign person, provided the foreign limited partners have no control or access rights; and critical technologies eligible for certain EAR licence exceptions.

One caveat matters here: the CFIUS regulations themselves work with no list of "countries of special concern" — the country filter in the rules runs the other way, through the carve-out for excepted foreign states (31 CFR § 800.218). Outside the regulations, in policy and in adjacent regimes, the recurring list of foreign adversaries is China (including Hong Kong and Macao), Russia, Iran, North Korea, Cuba and Venezuela. The "America First Investment Policy" memorandum of 21 February 2025 established a two-pole approach: for investors from these jurisdictions control is tightened — especially in deals involving AI, semiconductors and quantum technologies — while for allies a fast-track regime is introduced, subject to "verifiable distance" from adversaries. Capital from adversary countries more often falls under mandatory notification and in-depth review.

The one genuine exemption: excepted investors

The regulations contain a single origin-based exemption, and it shows what a passport test looks like when a regulator actually writes one. An excepted foreign state is currently one of four: Australia, Canada and the United Kingdom (from 13 February 2020) and New Zealand (from 5 January 2022); the UK determination excludes the Overseas Territories and Crown Dependencies (31 CFR § 800.218). An excepted investor under § 800.219 is a national solely of such states, their government, or an entity that passes every limb of a chain test applied to itself and each parent: organised and headquartered in an excepted state or the US; at least 75% of board members and 75% of observers being US or excepted-state nationals; every foreign person holding 10% or more of votes, profits, liquidation proceeds or control itself qualifying; and the minimum excepted ownership held by qualifying persons. A five-year look-back disqualifies an investor with a CFIUS misstatement or mitigation breach, a presidential order, an OFAC penalty or settlement, an export-control debarment or violation, or a US felony; listing on the BIS Entity or Unverified List disqualifies outright; and the status must still hold three years after completion. What the status removes is covered-investment jurisdiction over minority stakes and the duty to file a mandatory declaration; what it does not remove is jurisdiction over a control transaction, which remains reviewable on a voluntary notice or a non-notified inquiry. A fictional Canadian fund with a 12% Chinese state-owned limited partner therefore fails the test, whatever its own domicile says.

Minority stakes: the covered investment test

CFIUS jurisdiction does not end at control. A non-controlling investment in a TID US business is a covered investment under 31 CFR § 800.211 if it gives the foreign investor any of three rights: access to material non-public technical information; membership, observer status or the right to nominate a member on the board or an equivalent body; or involvement, other than by voting shares, in substantive decision-making on sensitive data, critical technologies or critical infrastructure.

The mirror image is the passive carve-out of § 800.302: holding 10% or less of the voting interest stays outside jurisdiction only if the investment is solely passive. Negotiate a single contractual control right or a board seat on top of a 9% stake, and the carve-out is gone. In practice this means the term sheet — information rights, director appointment, veto catalogue — determines CFIUS exposure more than the percentage does.

Notification procedure

• Parties may file either a short-form declaration (5-page declaration) or a full notification (detailed description of the transaction)
• Review period for short-form declaration - 30 days
• Review period for full notification — 45 days (31 CFR § 800.503)
• If the case moves into an in-depth investigation — a further 45 days (31 CFR § 800.508), extendable once by 15 days in extraordinary circumstances
• If the transaction is referred to the President — 15 days to act

What clearance buys. Clearance is a statutory safe harbour, not a comfort letter. Once the Committee has advised the parties in writing that it has concluded all action, its authority over that transaction falls away (31 CFR § 800.701); the statute lets it reopen only where a party submitted false or misleading material information or omitted material information, or materially breaches a mitigation agreement and no other adequate remedy exists (50 U.S.C. § 4565(b)(1)(D)). That is the concrete value weighed against the cost of a voluntary filing — and the official part of the cost is published: a formal notice carries a fee tiered by transaction value — none below $500,000, $750 from $500,000, $7,500 from $5 million, $75,000 from $50 million, $150,000 from $250 million and $300,000 from $750 million (31 CFR § 800.1101) — and the Staff Chairperson does not accept the notice until it is paid (§ 800.1102); the short-form declaration is filed without a fee. Adviser fees sit on top and are not fixed by any rule.

Practice shows that CFIUS can not only block transactions at the stage of their conclusion, but also require divestment of already acquired assets if they are subsequently deemed to threaten national security. In May 2024 the President ordered MineOne, a Chinese-owned crypto-mining operator, to divest real estate acquired in June 2022 within a mile of F.E. Warren Air Force Base — a deal that had never been filed and reached CFIUS through a public tip.

The scale of the non-notified machinery is visible in the Committee's annual report for 2024 (released 6 August 2025): 209 notices and 116 declarations filed; 116 of the notices went to a second-stage investigation; 98 non-notified transactions were examined, 76 formal inquiries opened and 12 filing requests issued; five civil penalties were imposed in one year, the largest $60 million; and 242 mitigation agreements and conditions were under monitoring.

United Kingdom: National Security and Investment Act

In the United Kingdom, the key law for reviewing foreign investments is the National Security and Investment Act, adopted in 2021, which significantly expanded the British government's powers to review and block foreign investments.

Types of transactions subject to review

• acquisition of control in companies by investors of any nationality — the Act's mandatory limb turns on the sector and the trigger event, not on where the acquirer is from
• investments in 17 sensitive areas of the economy (including defence, energy, AI, quantum technologies, communications, data infrastructure, synthetic biology)
• acquisition of significant influence or control over qualifying assets (land, tangible property, IP) in sensitive contexts

Mandatory notification is required in cases of

• Crossing the thresholds of more than 25%, more than 50%, or 75% and above of shares or voting rights in a company active in one of the 17 specified areas (NSI Act s. 8)
• Acquiring voting rights that enable the person to secure or prevent the passage of any class of resolution governing the affairs of such a company
• The trigger events are defined by statute; the 17 areas — by the Notifiable Acquisition Regulations 2021

Transactions subject to mandatory notification cannot be completed without prior clearance: transactions completed without permission are considered legally void and may result in serious fines and criminal liability for participants.

Material influence and voluntary filing

Acquiring material influence over a company's policy — through board representation, veto rights or contractual leverage, without crossing a shareholding threshold — is also a trigger event, but it is expressly outside mandatory notification. The same is true of acquisitions of control over assets. For these the parties choose: submit a voluntary notification and obtain a binding clearance, or close without one and live with the call-in power — the government may call an unnotified qualifying acquisition in for up to 5 years after completion, and up to 6 months after it becomes aware of the deal. The call-in power reaches back to trigger events from 12 November 2020 — before the Act commenced on 4 January 2022 — and only one call-in notice may be given per trigger event (s. 2). Clearance is correspondingly final: a final notification or final order can be revisited only where it was materially affected by false or misleading information, and even then a further call-in must follow within 6 months of the discovery (s. 22). A notifiable acquisition completed without approval is void, but not beyond cure: the acquirer may apply for retrospective validation, the Secretary of State must within 6 months of becoming aware either call the acquisition in or issue a validation notice, and a validation notice treats the acquisition as completed with approval (ss. 15–17) — 42 such applications were made in the year to 31 March 2026.

Notification procedure

• Submission of notification through a special online portal
• Review period — 30 working days from acceptance, extendable by a further 45 working days if the acquisition is called in, plus voluntary extensions by agreement; information requests stop the clock
• Volumes and outcomes are published annually. In the year to 31 March 2025 the unit received 1,143 notifications (954 mandatory, 134 voluntary, 55 retrospective validation), issued 56 call-in notices (7 for non-notified deals), 35 final notifications and 17 final orders; in the year to 31 March 2026 — 1,324 notifications (1,135 / 147 / 42), 60 call-ins (6 non-notified), 44 final notifications and 9 final orders, five of them in advanced materials and three in data infrastructure. Around 4.4–4.5% of notified acquisitions are called in; the median time to accept a mandatory notification rose from 7 to 11 days. Acquirers associated with China accounted for 18 of the 60 call-ins and 3 of the 9 final orders in 2025–26
• Reform is under way: on 22 July 2025 the government proposed exempting internal reorganisations and the appointment of insolvency officeholders from mandatory notification and opened a consultation on the 17 areas — standalone semiconductor and critical-minerals categories and a water sector — with secondary legislation to follow, so the list of areas is read in the version in force on the completion date

Germany: AWG/AWV — the continental contrast

Germany runs the most instructive continental regime: thresholds are lower than in the US or UK, the standstill is built into civil law, and below-threshold governance rights are caught by an explicit doctrine. The legal basis is the Foreign Trade and Payments Act (Außenwirtschaftsgesetz, AWG) and the Foreign Trade and Payments Ordinance (Außenwirtschaftsverordnung, AWV); the reviewing authority is the Federal Ministry for Economic Affairs.

Two tracks and three thresholds

• Sector-specific review (defence, weapons, certain classified IT): mandatory filing from 10% of voting rights, regardless of the investor's origin outside Germany
• Cross-sectoral review applies to non-EU/EFTA investors and is mandatory only for the case groups listed in § 55a AWV: from 10% of votes for critical infrastructure and media, from 20% for emerging technologies (semiconductors, AI, quantum, certain health technologies), from 25% for the remaining listed activities
• Acquisitions outside the catalogue are not notifiable, but the Ministry may open a review of its own motion — for up to 5 years after signing

Standstill and provisional invalidity

Where a filing is mandatory, the transaction is provisionally invalid (schwebend unwirksam) until clearance under § 15 AWG: the share transfer simply does not take legal effect. Before clearance the parties may not let the acquirer exercise voting rights, receive profit entitlements or obtain security-relevant information about the target — doing so is gun-jumping and carries criminal and administrative penalties. This is the sharpest contrast with the US model, where closing without a filing is expensive but not void.

Atypical control acquisition

German law explicitly reviews atypical control (§ 56(3) AWV): an acquisition below the voting thresholds combined with additional seats or majorities on supervisory bodies, veto rights over strategic decisions, or information rights may be treated as an acquisition of control and screened — provided, in the Ministry's own formulation, that the additional rights bring the investment to an intensity comparable to the threshold itself. The governance annex to a minority deal is therefore read as carefully as the cap table.

Canada: Investment Review Division

In Canada, foreign investments are reviewed under the Investment Canada Act; the relevant body is the Investment Review Division (IRD) within ISED. With the adoption of the National Security Review of Investments Modernization Act (Bill C-34, royal assent — March 2024), the regime tightened noticeably. Since September 2024 the minister may extend a review, impose interim conditions and close a case through investor undertakings, and the ceiling on daily penalties has been raised to 25,000 Canadian dollars. As a separate step the Act provides for a mandatory pre-closing filing for sensitive sectors, with a penalty of up to 500,000 Canadian dollars for failing to file, but it is switched on only by regulations naming the prescribed business activities; as at ISED's annual report for the year to 31 March 2025 those regulations had not been made, so the duty was not yet in force and starts only with their publication in the Canada Gazette. In that year ISED received 1,138 filings, ordered 30 extended national-security reviews and made one final order; the ministry's own guidance is to file at least 45 days before implementation.

Types of transactions subject to review

• acquisition of control in Canadian business
• investments in critical sectors (technology, resources)
• transactions involving state-owned foreign investors

National security reviews may be initiated for any transactions within 45 days after notification.

European Union: Regulation 2019/452

In the European Union, the framework for foreign investment control is still set by Regulation (EU) 2019/452, but the reform is now law. Regulation (EU) 2026/1386 of 17 June 2026 was published in the Official Journal on 26 June 2026 and entered into force on 16 July 2026; the bulk of it applies from 17 January 2028, and Regulation 2019/452 is repealed with effect from that same date (only a handful of preparatory and comitology articles apply from 16 July 2026). Under the new text all member states must have national screening with mandatory filing in a number of sectors — dual-use goods and military products, AI and quantum technologies, critical raw materials, and energy, transport and digital infrastructure — and the perimeter widens from foreign direct investment to "foreign investments".

Types of transactions subject to review

• acquisition of control in EU companies by foreign investors
• investments in critical sectors (semiconductors, AI, quantum technologies, etc.)
• direct and indirect acquisitions of control, including greenfield investments

Key elements of the system

• Two-tier structure: national control taking into account pan-European standards
• Coordination mechanism: information exchange between member states
• Veto power: final decision remains with national authorities

Review procedure

• Submission of notification through national or pan-European procedures
• Timing: under Regulation 2026/1386 the national initial review must not exceed 45 calendar days from a complete filing; within the cooperation mechanism member states give comments within 20 days and the Commission issues an opinion within 30 days, extendable once by up to 20 days
• Possibility of appeal in national courts and through the European Commission

Switzerland: Investment Screening Act

Switzerland has historically maintained the principle of openness and long did without any sectoral screening at all. Parliament adopted the country's first investment control law (Investitionsprüfgesetz, IPG) on 19 December 2025; the optional-referendum deadline expired on 17 April 2026, but the Act is still not in operation — the Federal Council sets the commencement date, and SECO expects a 2027 launch once the implementing ordinance is issued (a draft was published on 5 June 2026). Until then no applications can be filed or reviewed. The regime is deliberately narrow and reflects a liberal approach: only transactions involving foreign investors controlled by a state, in strictly defined critical sectors and above high thresholds, are subject to review.

Types of transactions subject to review

• acquisition of control in Swiss companies, especially in critical sectors
• investments by state-owned foreign investors

Critical sectors

• Defense industry, dual-use goods
• Energy, water supply
• Healthcare, transport and telecommunications infrastructure

Review procedure

• Two-phase scheme: preliminary application to SECO, then official application
• Federal Council makes decisions on politically sensitive transactions

Mandatory, voluntary, call-in, post-closing: four different mechanisms

The words "filing" and "clearance" hide four distinct legal situations, and confusing them is the most common structuring error. A mandatory filing is a statutory duty triggered by defined facts; a voluntary filing is an option that buys a safe harbour; a call-in is the regulator's power to summon a deal it was never told about; post-closing risk is what remains when none of the above has produced a clearance. The comparison below shows how the three reference regimes distribute them.

Note the status vocabulary: a filing submitted is not yet accepted (the UK clock starts on acceptance, the German clock on complete documents), and accepted is not cleared. Interim covenants in the transaction documents should be drafted against the correct status, otherwise the parties discover that their "approval obtained" condition was satisfied by a mere acknowledgement of receipt.

Before closing: screening, filing and the contract

National security review enters a deal long before any regulator sees it — through the timetable and the risk allocation between signing and closing.

1. Screening. Before the term sheet is agreed, both sides map the four fact groups (investor chain, asset, stake, rights) against every jurisdiction where the target has entities, assets, IP or data. The output is a filing list: where filing is mandatory, where a voluntary filing is worth its delay, and where the call-in risk is acceptable. On the sell side this is part of exit preparation — the logic is described in selling the business; for targets holding financial licences the change-of-control approval runs as a separate parallel track, see change of control in a licensed company.

2. Filing as a condition precedent. Where clearance must precede completion, the share purchase agreement makes it a condition precedent: signing fixes the price and obligations, closing happens only after approval. The drafting decisions are who controls the filing, how much the buyer must concede to obtain clearance (from "commercially reasonable efforts" to a hell-or-high-water clause), the long-stop date after which either party may walk away, and whether a break fee compensates the seller for a failed clearance. The mechanics of conditions precedent, long-stop dates and remedies belong to the SPA itself — see SPA and SHA mechanics — and are common to all regulatory conditions; GlobalWafers/Siltronic shows what a long-stop date that ignores a suspended clock costs: €50 million, with no prohibition needed.

3. Interim conduct. Between signing and clearance the standstill rules bite: in Germany the acquirer may not vote, take dividends or receive security-relevant information; in the UK completion itself is prohibited. Integration planning, data-room access and observer attendance must be designed so that they do not amount to early implementation.

4. Mitigation. If the regulator sees a manageable risk, clearance comes with conditions: national security agreements, restrictions on access to specific data or sites, appointment of security officers or approved proxies for governance rights, supply commitments, and in extreme cases carve-out of the sensitive business before completion. Mitigation converts a prohibition into a conditioned deal — at the price of ongoing compliance monitored for years, with breach penalties in the US now reaching the greatest of $5,000,000 or the value of the deal.

5. Unwind. If clearance is refused or never sought and the regime catches the deal, the endpoints differ by design: a void transaction in the UK, a provisionally invalid transfer in Germany, a divestment order in the US. In each case the forced seller bears the market risk of selling a flagged asset on a deadline — typically the worst possible negotiating position.

Three scenarios that decide most cases

Structuring and its limits

Deal structuring can legitimately reduce screening risk — but only by changing the facts the tests measure, not by masking them. Calibrating the rights package (no board seat, no veto, no technical information) can keep a financial investment genuinely passive. Staying below a voting threshold works only if no governance rights compensate for the missing votes; artificially splitting a transaction to duck a threshold is treated as circumvention and invites retrospective review. Carving the sensitive activity out of the target before signing removes the trigger asset itself. And an early, well-documented filing — mandatory or voluntary — is the only device that produces a safe harbour rather than an argument.

What does not work is identity engineering. A trustee or nominee holding, a "neutral" holding company or a second passport of the beneficial owner does not change ownership, funding, control or state links — the very facts every regime looks through to. At best it is ignored; at worst it is read as concealment, which shifts the case from jurisdiction to enforcement. The role holding structures can honestly play — organising ownership, financing and governance — is described in holding structures; their sanctions-related limits in the sanctions route map.

Whether to file voluntarily where no duty exists is a legal judgment made trigger-first: which tests the facts arguably meet, how severe the regime's post-closing powers are, and how durable the investment is meant to be. Cost and publicity are real factors, but they come after the legal analysis, not instead of it — a cheap silence today can price in a forced divestment tomorrow.

Evolution: global convergence of control

Over a decade, disparate national practices have converged into a recognizable standard: mandatory notification for a list of sensitive sectors, the right to retrospective review, and sanctions up to the forced sale of assets. In parallel, the transparency requirement has intensified — the regulator wants to see the ultimate beneficial owner — increasingly cross-checked against UBO registers — so beneficial ownership and nominee structures increasingly become the subject of a separate review, while formal holding structures without real presence raise questions.

For the investor, this changes deal preparation. It is no longer enough simply to register a conduit jurisdiction — you will have to prove economic substance and disclose the ownership structure down to individuals in advance. Choosing a country for the holding and carefully packaging the asset into an SPV do not eliminate screening, but a clean, disclosed structure reduces the risk that a transaction will be blocked or unwound after the fact.