Guidance

National Security and Investment Act 2021: guidance on compliance and enforcement

Updated 6 February 2024

This guidance explains how to comply with the National Security and Investment Act 2021 and what can be expected if you are subject to orders and notices. You should seek independent legal advice to help you comply with your obligations under the Act. Please check if you need to notify the government about an acquisition that could harm the UK’s national security.

References in this document to the ISU mean the Investment Security Unit within the Cabinet Office (CO).

Compliance obligations may be placed by the Secretary of State on the target business, the acquiring business, third parties, or numerous parties simultaneously. Parties should engage openly, fully and in good time to demonstrate compliance, for example by providing information as requested by the ISU to support assessment of acquisitions or to verify compliance with orders. The ISU aims to minimise the burden on businesses throughout their engagement with the requirements of the Act.

Notices and orders

The Act explains which notices and orders may be issued by the Secretary of State.

Call-in notice

The Secretary of State has the power to call in and assess qualifying acquisitions - referred to as trigger events in the Act which may give rise to a national security risk. Read about how Secretary of State expects to exercise the call-in power.

Information notice

If the government requires further information it may issue an information notice, which requires you to provide information to support the Secretary of State’s consideration. An information notice may be issued at any point: during the contemplation or progression of an acquisition prior to notification or to call-in; after it is called in; during the review and/or assessment periods; and/or after a final order has been placed.

The notice will set out the reason for requiring the information, how it should be provided, a time limit for providing the information and the potential consequences of not doing so. Should you not submit the required information by the due date, enforcement action may follow that could lead to monetary penalties or prosecution. The requirements of the notice and how to respond will be stated, and a contact point for the ISU will be provided.

Attendance notice

The government may also need to hear from people involved in the acquisition to inform its decision making. This will be required through an attendance notice, setting out the time and place of the meeting, and the purpose of the meeting. This could include you (the representative of a party involved in the acquisition), people in specific positions in one of the companies involved (for example someone with technical knowledge of the business), or others as required.

You and/or others whose attendance is requested must attend this meeting. If this is more than 10 miles from the recipient’s home address, necessary travelling expenses will be offered. The ISU may decide at their discretion that the meeting can be held virtually. If you fail to comply with an attendance notice, enforcement action may follow that could lead to monetary penalties or prosecution.

The attendance notice will state what you need to do, and ISU contact details will be provided.

Interim order

An interim order may be issued at any time during the assessment period. Interim orders are intended to prevent you or other parties to the acquisition taking any steps which might undermine any conditions the Secretary of State may seek to put in place at the end of the assessment period through a final order.

Interim orders could include (but are not limited to) preventing the exchange of confidential information and access to sensitive sites or assets, pending the outcome of the assessment, and may include compliance monitoring requirements. Interim orders will be sent to you by email.

The government may issue an interim order to any person (or to the holder of a position in the company), where provisions of the order are necessary and proportionate. Interim orders can apply to people outside the UK. You will be informed of the order’s details and rationale. The government will not routinely make interim orders public.

The order will set out the conditions with which you must comply. The actions you must take to demonstrate compliance will be given in the interim order. The ISU will monitor interim orders and may take steps to verify compliance. If you have concerns regarding the terms of an interim order, or how to demonstrate compliance, you should contact the ISU immediately.

Final order

A final order issued by the Secretary of State imposes conditions to mitigate national security risks. These may include:

• placing conditions on an acquisition prior to completing
• unwinding the transaction
• blocking the acquisition from taking place

Relevant parties will be provided with information about the decision. This includes details of any conditions imposed and the consequence of any breach of these conditions, once a national security assessment has been concluded.

Final orders may include both ‘structural’ and ‘behavioural’ conditions. Structural conditions would apply to the corporate structure of an organisation, including decision-making structures and ownership structures. An example might be excluding certain parts of an entity or certain assets from an acquisition or requiring government approval of proposed business locations. Behavioural conditions apply to the behaviour of people or organisations, for example a regular on-site security inspection or interviews with staff. They do not change corporate structures.

A final order remains in place until varied or revoked by the Secretary of State, but an expiry date may be applied to some of its conditions, or the whole order. You may be required to keep some or all of the terms of the order private. The ISU will inform you of any such requirements.

A publication notice for each final order made by the government will be published on GOV.UK. The publication notice will contain information about the order, such as to whom it applies, the start date, those subject to the order and a summary, but not the order itself. The government will remove sensitive information.

A final order will specify what you must do to demonstrate compliance with the conditions of the order. Alternatively, a compliance schedule may be attached to the order, providing details of requirements you must undertake to demonstrate compliance such as what evidence you will need to provide and when.

You should provide a primary point of contact for all matters relating to compliance with a final order. This may be a compliance officer, company secretary or other responsible officer. You should also provide an alternative contact if the first point of contact is unavailable.

Demonstrating compliance

It is important that any evidence you provide to the ISU is clear and unambiguous You should inform the ISU without delay of any changes that may affect your compliance or your ability to demonstrate compliance. This includes notifying the ISU immediately if you encounter problems complying with an order or notice, or if you identify or suspect non-compliance.

Requesting a review, variation, or revocation of an interim or final order

The Secretary of State will keep interim and final orders under review to ensure they remain necessary and proportionate. You can request that an interim or final order is reviewed, varied or revoked by notifying the Secretary of State via the ISU.

The Secretary of State is only required to consider such requests for final orders where there has been a material change of circumstances since the order was made or varied, or since the last request. The Secretary of State will consider requests as soon as practicable after receipt.

Monitoring and verifying compliance

Examples of compliance requirements you may be asked to undertake include, but are not limited to:

• providing the ISU with regular statements of compliance, at specified intervals - for example weekly, monthly, quarterly
• meetings in person or remotely between ISU and a senior member of staff in your organisation responsible for compliance with the order
• providing legal documents to prove that changes to the business structure have occurred, when specified in the order
• providing evidence for the implementation of security and governance structures specified in the order
• appointing a third-party technical assessor to report back to ISU on your compliance measures
• allowing site visits to verify provisions are being met

In addition, the Secretary of State may issue an information notice or attendance notice to obtain evidence of compliance with an interim or final order.

Your main contact for compliance will usually be with the ISU but other government departments may be involved. The ISU may keep compliance obligations under review and provide clarification to parties.

Enforcement

Offences

The NSI Act specifies the following offences:

• completing a notifiable acquisition without approval. Under the Act, if an acquirer completes a notifiable acquisition without first notifying and receiving clearance from the Secretary of State, that acquisition is void in law
• failing to comply with an interim or final order
• failing to comply with an information notice or attendance order, and various associated offences
• using or disclosing information in contravention of disclosure of information provisions

The statutory basis for offences under NSI can be found in Part 3, Section 32-36 of the NSI Act. Individual officers of a company may be guilty of an offence, as well as the corporate body.

Enforcement action

The Secretary of State will consider enforcement action when it is necessary to ensure compliance with the Act and the terms of orders and notices, to maintain national security, and to deter non-compliance. Examples of non-compliance that could result in enforcement action, and may constitute an offence, include:

• completing a notifiable acquisition without approval and without reasonable excuse
• failing to respond to an information notice or attendance notice, or providing incomplete information
• deviating from the terms of the compliance schedule, for example, changing the specified point of contact, without first consulting the ISU
• failing to submit evidence of compliance within the specified timeframe
• obstructive conduct, for example, unexplained complications or delays in providing evidence of compliance with interim or final orders
• failing to comply with the terms of an interim or final order, for example, submitting late or incomplete statements of compliance
• using or disclosing information in contravention of disclosure of information provisions

Where non-compliance occurs the ISU may take action short of penalties in some circumstances. This may include:

• reminders or warning letters
• requiring remedial action to secure compliance, immediately or within a specified time period
• implementing an improvement plan, which provides you with the opportunity to demonstrate compliance

Parties that do not adequately respond to actions short of penalty are likely to become subject to penalties.

Approach to civil monetary penalties

Penalties can apply to individuals, businesses, or both. The ISU will communicate to parties that they may be subject to a monetary penalty and will ask for information to help determine the penalty amount. For businesses the maximum penalty is 5% of turnover or an amount up to £10 million (whichever the higher).

For individuals the penalty will be based on a percentage of income, subject to the maximum levels set in the Act. Where an individual does not disclose the requested information, the Secretary of State may assume a level of income he/she considers reasonable to allow an appropriate penalty to be determined.

The Secretary of State may decide to use information and/or attendance notices to help determine the penalty.

To impose a monetary penalty the Secretary of State must be satisfied beyond reasonable doubt that an offence has been committed. You can make representations via the ISU, to provide any information you would like taken into account, before it is confirmed whether an offence has been committed and determined whether a penalty is appropriate.

The Secretary of State will apply a penalty at a level they consider appropriate, subject to the maximum specified in the Act. The Secretary of State will consider seriousness when deciding the level of monetary penalty, based on culpability of the offender and harm arising from the offence. Factors affecting seriousness may include:

• repeat or multiple breaches
• negligence
• fraud
• intentional avoidance or circumvention
• impediment to the operation of the Act

In addition to seriousness, the Act specifies that the Secretary of State will have regard to:

• the desirability of deterring both the person on whom the penalty is imposed and others from committing the offence to which the penalty relates
• the possibility, and desirability, of rectifying any failure to which the offence relates
• any steps taken by the person on whom the penalty is imposed towards rectifying any failure to which the offence relates
• the ability of the person on whom the penalty is imposed to pay the penalty

Penalties may be adjusted to remove any financial benefit offenders may have obtained as a result of committing the offence. The Secretary of State may also reflect in their assessment of penalty other aggravating and mitigating factors they consider relevant.

When the amount of penalty has been decided, parties will receive a penalty notice, along with a cost recovery notice if costs are applied. These notices will include the time period for payment and how payments can be made.

Approach to costs

The Secretary of State may require a contribution to the costs to government for dealing with an offence, for example to cover administration, investigation, or any specialist resource needed. In such cases a cost recovery notice will be issued.

Costs of a minimum £750 will usually be applied to cases of monetary penalty. This reflects the resources needed to investigate and administer a penalty. In more complex cases the Secretary of State may decide to apply higher costs and will provide a breakdown. More information on civil monetary penalties can be found in Section 40 of the Act.

Approach to criminal proceedings

The Secretary of State may decide to refer suspected offences under the Act to the police for possible criminal investigation. This will usually be considered only in the most serious matters. Once a matter is referred to the police, all decisions in respect of investigation, charging, and prosecution rest with the police and the Crown Prosecution Service.

More information on prosecution and criminal penalties can be found in the Sections 37-39 of the Act.

Appeals

Parties subject to penalties have the right to appeal the Secretary of State’s decision to impose a penalty, the amount of penalty, or the time period set for payment.

Appeals must be made within 28 days of receiving the penalty notice or cost recovery notice by commencing proceedings at the relevant Court (High Court of England and Wales, the Court of Session in Scotland or the High Court in Northern Ireland).

Interim and final orders cannot be appealed, however a request can be made to the Secretary of State to vary or revoke the order. Read about requesting a review, variation, or revocation of an interim or final order.

Judicial review

Judicial review is a legal review by a judge of a decision made by a public authority. Decisions made under the Act may be subject to judicial review. The Act specifies a 28-day time limit for judicial review proceedings to be instituted.

Responsibility to prevent market abuse

Throughout the review and assessment periods and in any interactions with the ISU, you should remain mindful of other legislative obligations that may apply. For example, a party which is a relevant issuer will still need to comply with applicable transparency and disclosure obligations such as the obligation under the UK Market Abuse Regulation.

If company disclosure obligations give rise to any doubts or concerns about the ability to comply with any specific requirements raised during the review and assessment process, please contact the ISU. See the Financial Conduct Authority website for further information on the UK Market Abuse Regulation.

Contact the Investment Security Unit

Email investment.screening@cabinetoffice.gov.uk with enquiries about compliance and enforcement, future acquisitions or a specific notification.