US buyers are used to building CFIUS and HSR into their deal timetable. The UK's National Security and Investment Act (NSIA) still catches some of them by surprise, and the cost of a surprise is high.

A mandatory regime with real teeth

The NSIA requires mandatory notification of acquisitions of control over entities active in 17 sensitive sectors, including defence, data infrastructure, artificial intelligence, communications and energy. Control is broadly defined: crossing 25%, 50% or 75% of shares or voting rights, or acquiring voting rights that allow the buyer to block resolutions.

A notifiable acquisition completed without approval is void. That is not a fine or a remedy that can be negotiated later. The transaction simply has no legal effect.

Where US buyers go wrong

In our experience, the issue is rarely a failure to understand the regime. It is a failure to ask the question early enough. Three patterns recur:

• Sector mapping happens too late. A target that describes itself as "business services" may hold data, run communications infrastructure or supply a government customer. The sector analysis needs to be done on what the business actually does, not how it presents itself.
• Indirect holdings are missed. A US buyer acquiring a US parent may acquire control of a UK subsidiary in a sensitive sector. The UK filing obligation follows the subsidiary.
• The timetable is treated as an afterthought. The initial review period is 30 working days from acceptance of the notification, and a call-in for a full assessment adds a further 45 working days, which can be extended. That has to sit inside the long-stop date.

Voluntary notifications and the call-in power

Even where a deal falls outside the mandatory sectors, the government can call in an acquisition for review if it may raise national security concerns. That power can be used for up to five years after completion, or within six months of the government becoming aware of the deal. For buyers with sensitive customers, supply chains or data, a voluntary notification can buy certainty. Sellers increasingly ask for one where the buyer's ownership or financing has links to jurisdictions of concern.

Remedies are commercial, not just legal

Most notified deals are cleared without conditions. Where conditions are imposed, they tend to be practical: restrictions on access to sensitive information, requirements to maintain UK capability, or security arrangements around specific contracts. These can affect the buyer's integration plan and the value it expects to unlock. They should be discussed with the business, not just the lawyers.

Building one regulatory timetable

The answer is not more filings but better coordination. On transatlantic deals we now run a single regulatory workplan that covers HSR, CFIUS, the NSIA and any EU or national filings together. Each regime asks overlapping questions about the buyer, its investors and its government relationships. Answering them once, consistently, saves time and avoids inconsistencies that regulators notice.

Key takeaways

• Map the target's UK activities against the 17 sectors at the term sheet stage.
• Look through the group structure for UK subsidiaries that may trigger a filing.
• Build NSIA timing and a mandatory approval condition into the purchase agreement.
• Coordinate US and UK national security reviews from a single workplan.

If you are planning an acquisition with a UK element, please get in touch with Hannah Whitfield in London or Daniel Okafor in Washington DC.