CMS Expert Guide to Foreign Investment Screening Laws in United Kingdom

The UK FDI regime is set out in the National Security and Investment Act 2021(the “Act”), which came into force on 4 January 2022.

It must be read in conjunction with the National Security and Investment Act 2021 (Notifiable Acquisition) (Specification of Qualifying Entities) Regulations 2021, which provide detailed descriptions of the specified activities in 17 sensitive sectors of the economy that may trigger a mandatory notification requirement.

The UK FDI regime falls into two parts: (i) a mandatory regime, where clearance must be obtained before closing; and (ii) a voluntary regime, which does not require clearance before closing, but remains subject to the ‘call-in’ powers of the Secretary of State ("SoS").

Importantly, the UK FDI regime applies to any investor, including investors from the UK (no foreign nexus required).

For a mandatory notification to be required, there needs to be: (i) a trigger event; over (ii) a Qualifying Entity (i.e. excluding asset acquisitions); and (iii) that Qualifying Entity must undertake specified activities in the UK in at least one of 17 sensitive sectors of the economy identified by the UK Government.

2.1.1 Relevant type of transaction (“Trigger event”)

The mandatory regime only covers share deals. Trigger events for mandatory notifications are:

• The percentage of shares or voting rights in the Qualifying Entity held by the acquirer increasing to more than 25%, more than 50% or at least 75%.
• The acquisition of voting rights in the Qualifying Entity enabling the acquirer to secure or prevent the passage of any class of resolution governing the affairs of the Qualifying Entity.

Internal reorganisations may be subject to a mandatory filing where they result in a trigger event in relation to a Qualifying Entity, even if the ultimate beneficial owner of the entity remains the same.

2.1.2 Relevant target entities (“Qualifying Entity”)

A Qualifying Entity is any entity, whether or not a legal person, including: (i) a company; (ii) a limited liability partnership; (iii) any other body corporate; (iii) a partnership; (iv) an unincorporated association; or (v) a trust.

An entity which is formed or recognised under the law of a country or territory outside the UK is a Qualifying Entity if it carries on activities in the UK or supplies goods or services to persons in the UK. In other words, the acquisition of legal entities which are not established in the UK and which have no physical presence in the UK can still be caught by the UK regime as a result of supplies made to the UK. However, for the purposes of the mandatory regime, the entity must carry out specified activities in the UK.

2.1.3 Sensitive sectors

A trigger event in relation to a Qualifying Entity will only give rise to a mandatory notification requirement if that Qualifying Entity undertakes specified activities in the UK in at least one of 17 sensitive sectors of the economy identified by the UK Government. These sectors are: Advanced Materials; Advanced Robotics; Artificial Intelligence; Civil Nuclear; Communications; Computing Hardware; Critical Suppliers to Government; Cryptographic Authentication; Data Infrastructure; Defence; Energy; Military and Dual-Use; Quantum Technologies; Satellite and Space Technologies; Suppliers to the Emergency Services; Synthetic Biology; and Transport. The relevant activities in each sector are specified in the National Security and Investment Act 2021 (Notifiable Acquisition) (Specification of Qualifying Entities) Regulations 2021.

The Government consulted on amendments to these regulations in July 2025, including:

• changes to some of the current definitions of specified activities in the 17 sensitive sectors;
• new standalone definitions for activities in the Critical Minerals and Semiconductors sectors (currently covered within Advanced Materials and Computing Hardware); and
• a new mandatory notification requirement where the Qualifying Entity undertakes specified activities in the Water sector.

The consultation closed in October 2025 and the Government’s response has not yet been published.

Any acquisition that does not trigger a mandatory notification may be notified voluntarily if a trigger event takes place (or will take place as a result of arrangements in progress or contemplation) in relation to a Qualifying Entity or a Qualifying Asset.

The SoS may decide to ‘call-in’ for further scrutiny any such acquisition that has not been voluntarily notified on his/her own initiative. In practice the Investment Security Unit proactively monitors market intelligence and regularly issues call-in notices in respect of non-notified transactions. Parties to acquisitions that do not meet the criteria for mandatory notifications therefore need to consider if their acquisition may raise (or appear to raise) national security questions, and if so, whether voluntary notification may be advisable in the interests of deal certainty.

2.2.1 Relevant type of transaction (“Trigger event”)

Under the Voluntary Regime, the list of trigger events also includes (in addition to trigger events that are relevant to the Mandatory Regime) acquisitions that, whether alone or together with other interests or rights held by a person, enable that person to exercise “material influence” over the Qualifying Entity.

The assessment of material influence requires a case-by-case analysis of the overall relationship between the relevant parties, which may include an assessment of shareholdings, board representation, and other sources of influence. Government guidance confirms that the assessment of material influence under the UK FDI regime will be similar to the assessment of this concept adopted by the UK Competition and Markets Authority in the context of UK merger control rules.

2.2.2 Relevant target assets (“Qualifying Asset”)

A trigger event takes place in relation to a Qualifying Asset where a person acquires a right or interest in (or in relation to) the asset and as a result the person is able:

• to use the asset, or use it to a greater extent than prior to the acquisition; or
• to direct or control how the asset is used, or direct or control how it is used to a greater extent than prior to the acquisition.

A Qualifying Asset covers land, tangible (or, in Scotland, corporeal) moveable property, and ideas, information or techniques which have industrial, commercial or other economic value. 

Land or tangible moveable property situated outside the UK or its territorial sea, or any intellectual property, will only constitute a Qualifying Asset if it is either: (i) used in connection with activities carried on in the UK; or (ii) used in connection with the supply of goods or services to people in the UK.

Notification under the Mandatory Regime is compulsory, and the acquisition cannot close before clearance by the SoS. In contrast, any acquisition that falls within the scope of the Voluntary Regime can close without prior approval by the SoS.

Potential consequences for not notifying, including sanctions, are described in response to Question 6 below.

To assess the likelihood of a risk to national security, the SoS will consider primarily three risk factors:

• Target risk: in assessing the target risk, the SoS will consider what the target does, is used for, or could be used for, and whether that has given rise to, or may give rise to, a risk to national security. Assessment of the target risk may also involve consideration of any national security risks arising from the target’s proximity to sensitive sites. Qualifying Entities that undertake specified activities in the areas of the economy subject to the Mandatory Regime, or closely linked activities, are more likely to raise a target risk. Government guidance states that any sensitive supply relationships with Government in those areas will also be taken into account, as well as any national security risks presented by cumulative acquisitions. In some cases, the target may be considered so sensitive that the acquisition will need to be reviewed regardless of the acquirer risk.  
• Acquirer risk: the assessment will be based on the characteristics of the acquirer such as the sector(s) of activity, technological capabilities and links to entities which may seek to undermine or threaten the national security of the UK. Some characteristics, such as a history of passive or long-term investments, may indicate low or no acquirer risk. Government guidance expressly states that the SoS does not regard state-owned entities, sovereign wealth funds or other entities affiliated with foreign states, as being inherently more likely to pose a national security risk. However, where these entities have ties or allegiances to states or organisations hostile to the UK, this will inform the assessment of acquirer risk. The SoS will also consider any political, military or state-backed influence or obligations, particularly where there are links to countries with high degrees of government surveillance or with powers to compel acquirers to share data or provide assistance to, for example, intelligence agencies. In addition,  the Government has confirmed that it will take acquirer intent and historic behaviour into account when assessing a transaction.
• Control risk: this refers to the amount of control the acquirer gains of an entity’s activities or strategy. It also concerns the amount of control over an asset, which includes controlling or directing its use, as well as using it. A greater degree of control may increase the possibility of a target being used to harm national security. It may also enable parties to reduce the diversity of a market, or influence the market’s behaviour, in a way that may give rise to a risk to national security. Government guidance indicates that the SoS will consider whether the amount of control obtained by the acquirer gives it the ability to influence the policy of the target, for example through access to board seats or other decision-making arrangements. Historic patterns of voting/shareholder activism may be considered, as well as the possibility of acquiring control through the exercise of financial instruments.

The UK’s FDI regime is administered by the Investment Security Unit (the “ISU”) within the Cabinet Office, under the direction of the SoS.  

The acquirer is responsible for filing a mandatory notification form. A voluntary notification form can be submitted by the acquirer, the Qualifying Entity or the seller.

For ease of presentation, we distinguish below between notified acquisitions (under the Mandatory Regime or the Voluntary Regime), and those called-in by the SoS in the absence of notification.

Acquisitions notified by the parties

After submission of a notification (whether mandatory or voluntary), the ISU will confirm whether the notification form is complete and complies with the requirements of the Act. The average time taken for this assessment is seven working days for mandatory notifications and ten working days for voluntary notifications.

If the notification form is incomplete and/or does not comply with the requirements of the Act, the ISU may request that the missing information be provided or reject the submission altogether (in which case a new submission will have to be made).

If the notification form is accepted, the SoS will have an initial period of up to 30 working days to either clear the acquisition or call it in for a full national security assessment. If an acquisition is called in for a more detailed review, the SoS has an additional 30 working days to undertake a detailed national security assessment. This period can be extended by a further 45 working days, and possibly longer where agreed by the SoS and the notifying party.  In practice the review period can be drawn out and there have been reports of reviews taking over 100 working days. The ISU also makes frequent use of ‘stop the clock’ when questionnaires are issued, which can extend the process even further in real time.

At the end of the review period, the SoS will either clear the acquisition, or issue a final order:

• placing conditions on the completion of the acquisition – typical remedies seen in cases to date include restrictions on information flows, appointment of a Government observer to the board, controls relating to visitors/staff/site security and requirements to maintain certain capabilities in the UK; or
• unwinding the transaction or blocking the acquisition from taking place.

A final order remains in place until varied or revoked by the SoS, but an expiry date may be applied to some of its conditions, or the whole order. Failing to comply with a final order may be sanctioned by imprisonment and/or a fine.

Acquisitions called-in by the SoS on own initiative

Where the SoS calls-in an acquisition that has not been notified, the SoS has 30 working days to undertake a detailed national security assessment. This period can be extended by a further 45 working days, and possibly longer where agreed by the SoS and the parties.

Aside from there being no 30-day initial review period, the procedure is otherwise identical to that described in relation to acquisitions notified by the parties. 

There are no administrative fees for proceedings under the Act.

The Government is required to make public the fact that a final order has been issued imposing conditions on clearance or prohibiting a transaction/requiring divestment. However, it is not required to publish the decision in full: a very short summary is published on a dedicated webpage, confirming the parties, the trigger event and a brief description of any conditions imposed.

The Government is not required to publish information about call-in notices or unconditional clearance decisions, and generally does not do so in practice. However, in a small number of cases the Government has issued a short press release, in circumstances where one of the parties to the transaction has already made public the fact that a call-in notice or clearance decision has been issued (e.g. through a regulatory announcement).

In addition, the Government is required to publish an Annual Report on the operation of the UK FDI regime, which includes aggregate statistics about decisions issued, including the origin of investment/nationality of acquirers and the sectors affected.

Completing an acquisition subject to mandatory notification without approval will risk a penalty of up to 5% of the acquirer’s group worldwide turnover or £10 million (whichever is higher), and imprisonment for individuals for up to five years.

In addition, the acquisition will be legally void and of no legal effect. However, the Act provides for the possibility of submitting a retrospective validation application. If successful, a validation notice will be issued, providing that the acquisition to which it relates is to be treated as having been completed with the approval of the SoS (and, accordingly, is not void anymore).

An acquisition subject to the mandatory regime can be called-in at any time by the SoS, provided that this takes place before the end of a six-month period after the SoS becomes aware of the acquisition.  There is otherwise no time limit on the SoS’ ability to call-in a transaction which should have been notified and was not.

Under the voluntary regime, the parties are allowed to close the acquisition without clearance. However, if the transaction is subject to review (either following a voluntary notification or an own-initiative call-in by the SoS) and the parties choose to complete before the SoS has made his/her final decision, the acquisition could later be unwound if national security concerns are identified. An interim order may also be put in place preventing further implementation of the transaction pending the conclusion of the SoS’s review.

The SoS can call-in acquisitions subject to the voluntary regime that have not been notified for up to 5 years after completion (provided the SoS does so up to 6 months after becoming aware of the acquisition).