Skip to main content

National Security And Investment Act 2021

08 December 2021

The National Security and Investment Act 2021 (“NSI Act”) provides the UK government with new powers to scrutinise investments on national security grounds. The regime set out in the NSI Act will come into force on 4 January 2022, although it also contains powers that can be exercised retroactively in respect of transactions completed back to 12 November 2020.

In this briefing we provide a brief overview of the NSI Act and its entry into force and consider which transactions may be affected by it. 

What is the National Security and Investment Act 2021?

The NSI Act establishes a new standalone regime for the scrutiny of, and intervention in, acquisitions and investments in the UK for the purposes of protecting national security.  Key features include:

  • mandatory notification of some transactions in 17 specified sectors (see below);
  • voluntary notification for certain transactions that may give rise to national security concerns; and
  • call-in powers under which the government’s powers to “call-in” transactions across all sectors of the economy on national security grounds are significantly extended. 

Which transactions does the regime in the NSI Act apply to?

Once it has fully commenced1 , the regime in the NSI Act will apply to specified categories of transaction or investment that involve the acquisition or control over certain “qualifying entities” or “qualifying assets”.  

Both domestic UK and foreign entities are caught by the NSI Act. A “qualifying entity” is widely defined as an entity (including a company, LLP, any other body corporate, partnership, unincorporated association or trust) other than an individual. A foreign entity will be a “qualifying entity” if it carries on activities in the UK or supplies goods or services to the UK.

Notably, there are no financial thresholds, nor de minimis exemptions under the NSI Act.

What is the mandatory notification regime?

The test for the mandatory notification regime is broadly in two parts, there must be: (i) a trigger event; and (ii) the transaction must involve a qualifying entity in one of the 17 high risk sectors identified (see below).

From 4 January 2022, buyers of shares or voting rights (exceeding certain thresholds) in one or more of the 17 high risk sectors identified will need to seek prior authorisation from the Secretary of State for Business, Energy and Industrial Strategy (“BEIS”), via the newly created Investment Security Unity (“ISU”), before completing the transaction.

As mentioned above, there is no de-minimis: a transaction that is subject to the mandatory notification regime will need to be notified irrespective of the parties’ combined share of supply or the target’s turnover.

Which transactions are caught by the mandatory notification Regime?

The mandatory notification regime (and an associated stand-still) will apply to  the direct or indirect acquisition of more than 25%, more than 50% or 75% or more of the shares or voting rights in qualifying entities (this includes increases in existing shareholdings), or the acquisition of voting rights that enable or prevent the passing of a company resolution. The target entity must fall within one of the 17 high risk sectors listed below.  

This aspect of the regime only applies to acquisitions of qualifying entities (and not asset acquisitions which are in scope for the voluntary element of the regime).  

It will be unlawful to complete a notifiable acquisition that falls within the mandatory notification regime unless and until it is approved. Failure to notify a transaction will render the transaction void, and civil and criminal penalties may be imposed. This means that transactions which may fall within the mandatory notification regime will have to be structured so that completion cannot occur until the requisite clearance is obtained.

What are the 17 key sectors?

  • Advanced materials
  • Artificial intelligence
  • Communications
  • Critical suppliers to Government
  • Cryptographic authentication
  • Defence
  • Military and dual-use
  • Satellite and space technology
  • Transport2
  • Advanced robotics
  • Civil nuclear
  • Computing hardware
  • Suppliers to the emergency services
  • Data infrastructure
  • Energy
  • Quantum technologies
  • Synthetic biology 

What is the voluntary notification regime?

In addition to the mandatory notification regime, parties may notify transactions to the Secretary of State on a voluntary basis. This regime is broad and may cover acquisitions of shares, voting rights or qualifying assets where there is a perceived risk that the transaction may be ‘called in’ for review.

In particular, acquisitions of bare assets (such as the transfer of IP) could be caught.  A qualifying asset may be: (i) land; (ii) tangible moveable property or (iii) ideas, information or techniques with value (such as trade secrets, source code, algorithms, formulae, designs, plans, drawings and software). Foreign assets may also be qualifying assets if they are used in connection with activities carried on in the UK, or the supply of goods or services to persons in the UK.

In addition, acquisitions of 25% of the shares or votes in an entity, or passing through 25%, 50% or 75% of the shares or votes as well as the acquisition of “material influence” (usually regarded as 15% or more of the shares or votes; but sometimes less) are also within the scope of the voluntary notification regime.  

Parties to transactions falling outside the mandatory regime will need to consider carefully the risks of not notifying – the main risk is that the transaction may be “called-in” for detailed scrutiny, and if found to raise national security concerns, could be unwound.

What are the “call-in” powers?

The Secretary of State has the power to “call-in” any transaction that is within the scope of the regime – irrespective of whether it has been notified; this is only to assess its risk to national security. The “call-in” power can be exercised for up to six months after the Secretary of State becomes aware of the transaction, provided that it is within five years after completion.  However, for the mandatory notification regime the five year long-stop period does not apply.

The right to call-in has retrospective effect, so any relevant transactions entered into from 12 November 2020 may potentially be called-in.

When exercising the “call-in” power, the Secretary of State must have regard to the ‘Section 3 statement3 consider:

  • target risk – the nature and activities of the target;
  • control (trigger event) risk – the type and level of control being acquired and how it could be used; and
  • acquirer risk – the extent to which the acquirer raises national security concerns.

Notably, the Section 3 statement does not give any indication of the substantive factors that the government would take into account in assessing whether the target, transaction or acquirer would give rise to national security concerns, nor does it define what is meant by ‘national security’. This is intentional and provides the government with maximum flexibility to protect the UK from security concerns.

Does the regime apply only to overseas investors?

As noted above, the NSI Act does not include the concept of a foreign investor. The focus of the regime in the NSI Act is on the activities of the target relevant to national security, meaning that transactions involving UK investors are as likely to be caught as acquisitions by overseas investors from countries considered to be hostile towards the UK. However, when consideration is given as to which transactions should be “called-in” for scrutiny, it seems rather more likely that the nationality of the investor or purchaser is likely to be taken into account, and the level of concern in relation to national security is likely to be higher where the investor or purchaser is based in a state that is considered to be hostile towards the UK.

What is the notification process?

Notification under the NSI Act will be dealt with by the ISU. The information to be included in the notification is set out in secondary legislation. The ISU can be contacted now (by emailing for informal advice on the new regime.

Broadly, the timetable for processing notifications will be: (i) 30 working days to review the notification; and (ii) 30 working days, which may be extended by 45 working days and potentially a further voluntary period, to undertake the national security assessment. This means that the total time for review is up to 105 days (or even longer if a voluntary period is agreed). If an ‘information notice’ or ‘attendance notice’ is issued at any point, the clock stops, and starts running either after compliance with the notice or the deadline given to comply has passed – this is to ensure that the government is not timed out of an investigation by the parties deliberately delaying proceedings.

Are there penalties for non-compliance?

As noted above, notifiable acquisitions which complete without approval will be legally void. In addition, there will be civil and criminal penalties for completing a notifiable acquisition without approval. The penalties include imprisonment for up to five years, fines of up to £10 million (or, if higher, 5% of worldwide turnover) and disqualification as a director for up to 15 years.   

What does this mean for M&A transactions?

There has been much debate around the government’s power to apply the provisions of the NSI Act retrospectively to some transactions when the regime comes into force on 4 January 2022.

For transactions completing between 12 November 2020 and the commencement of the NSI Act, the six month and five-year periods for “call in” will apply from the commencement date of the relevant provisions of the NSI Act.  The retrospective power may be exercised cautiously, and possibly only in relation to transactions raising serious national security concerns – although this remains to be seen. In the interim, before the regime comes into force, if there are concerns as to whether a transaction may be subject to retrospective call-in, it is possible to discuss this informally with the Investment Security Unit.

Those engaged in M&A transactions now should keep the requirements of the NSI Act in mind; this is particularly important for transactions which have a gap between exchange and completion and which sign before the regime comes into force, but complete after it comes into force. In such circumstances, consideration should be given as to whether a mandatory notification will be required, and whether an appropriate condition should be included in the acquisition agreement. Where the transaction does not fall within the mandatory regime, the parties should assess the risk of such transactions being “called-in”.

In addition, when the mandatory regime is fully in force, qualifying transactions in the 17 key sectors will need to be conditional on the appropriate clearance being obtained. The approval process and timetable will have to be factored into the transaction timetable. 

In relation to transactions that are not obviously notifiable, there may be some impact of the NSI Act on risk allocation under the transaction documents, particularly if there is some doubt as to whether the transaction is caught. Where there is genuine doubt as to whether the transaction is caught by the NSI Act the penalties may result in buyers making precautionary notifications and there may be a need to allocate the five-year post completion call-in risk – it remains to be seen how the market responds to these areas.

Does the NSI Act have implications for other transactions?

The NSI Act is much broader than traditional M&A deals, and the trigger events mean that minority investments as well as (in the context of the voluntary regime) acquisitions of, or transactions giving control over assets such as land or IP may trigger it.  

Acquirers and investors should keep the wide scope of the NSI Act in mind and conduct careful due diligence to understand whether the target’s activities are in a sensitive sector giving rise to national security implications and whether a mandatory notification is required or a voluntary notification would be wise. They should also keep in mind that the NSI Act will apply to any follow-on transactions such as further funding rounds or secondary acquisitions. 


1: Certain provisions of the NSI Act that enable the making of regulations came into force on 29 April 2021 when the Act received Royal Assent. In addition, the National Security and Investment Act 2021 (Commencement No.1 and Transitional Provision) Regulations 2021 (SI 2021/788) brought in certain provisions of the NSI Act from 1 July 2021; the full regime will enter into force on 4 January 2022.

2: The National Security and Investment Act 2021 (Notifiable Acquisition) (Specification of Qualifying Entities) Regulations 2021 contain detailed definitions of the businesses and activities that fall within scope of the mandatory notification regime.

3: For details, see: National Security and Investment Act 2021: Statement for the purposes of section 3 - GOV.UK (

Related items

Back To Top