Research and analysis

RPC opinion: impact of National Security (State Threats) Bill

Published 14 August 2026

Lead department: Home Office

Summary of proposal: to introduce a new State Threats Designation Power through primary legislation. The power would allow the Secretary of State for the Home Department to designate state and state linked bodies engaged in foreign power threat activity. Secondary legislation would be used to bring individual designations into force. Designation would trigger new offences relating to support for, assistance to, or obtaining material benefits from a designated body.

Submission type: impact assessment

Legislation type: primary

RPC reference: RPC-HO-26174-IA(1)

Date of issue: 10 August 2026

RPC opinion rating

Fit for purpose:

• the impact assessment (IA) provides a sufficient case for intervention, options assessment and preferred way forward. sets out a clear strategic and legal rationale for intervention, considers an adequate range of options including non-regulatory alternatives, provides a sufficient small and micro business assessment, and supports the preferred option with proportionate quantitative and qualitative analysis despite significant uncertainty
• the committee would like to note that the IA is a good example of a proportionate approach

RPC opinion summary

Rationale: Green

The IA sets out a sufficient strategic and legal rationale for intervention. It identifies the gap in the existing state threats framework, explains why terrorism proscription is not appropriate for state bodies. The IA would be strengthened by clearer SMART objectives and a sharper explanation of how the additional designation power changes outcomes beyond the existing National Security Act 2023 powers.

Identification of options: Green

The IA considers a sufficient range of regulatory and non-regulatory options and applies critical success factors to explain the preferred option. The small and micro business assessment is sufficient and explains why exempting small, micro and medium-sized businesses would undermine the regime. The IA would be strengthened by more clearly explaining whether any less ambitious legislative “do minimum” option was considered and by developing the comparison of costs and operational trade-offs for options 2 and 3.

Justification for preferred way forward: Green

The IA provides sufficient quantitative and qualitative analysis to support the selection of the preferred option. Monetised costs are low relative to plausible avoided national security harms, and the IA recognises the uncertainty around deterrence and behavioural responses.

Regulatory scorecard: Satisfactory

The scorecard identifies the main welfare, business and household impacts and is transparent that the monetised net present social value (NPSV) is negative while the expected benefits are largely non-monetised. The scorecard would be improved by reporting the equivalent annual net direct cost to business (EANDCB) clearly, explaining the direct/indirect treatment of business impacts, and ensuring the directional rating of business non-monetised impacts reflects both potential benefits and risks of over-compliance or chilled legitimate activity.

Monitoring and evaluation: Satisfactory

The IA sets out relevant evaluation questions, data sources, use of process and impact evaluation, case studies, ongoing monitoring and a post implementation review before the end of Parliament in 2029. The plan would be strengthened by specifying baselines, metrics, data owners, frequency of review, trigger points for policy adjustment and how the department will assess business impacts and unintended consequences.

Summary of proposal

The Home Office proposes to introduce a new State Threats Designation Power through primary legislation. The power would allow the Secretary of State for the Home Department to designate state and non-state bodies, including proxies, that carry out foreign power threat activity against the UK or its interests. Individual designations would be brought into force through secondary legislation. Once a body is designated, new criminal offences would apply, including offences relating to assisting or obtaining material benefits from a designated body and supporting a designated body.

The IA explains that the proposal builds on the National Security Act 2023, which introduced a framework for responding to modern foreign state threats. The department considers that the existing framework does not allow the government, law enforcement and intelligence agencies to take sufficiently targeted action to disrupt the most egregious state or state-linked actors. The IA explains that terrorism proscription under the Terrorism Act 2000 was not designed for state bodies and that using it for such organisations could create legal and policy risks, including concerns about the effect of “banning” membership of state bodies.

The preferred option is intended to make the UK a harder operating environment for state and state-linked bodies. The IA explains that designation would support improved disruption and prosecution of those working for or on behalf of designated bodies and create a deterrent effect for individuals and businesses that might otherwise support or assist those bodies. The IA presents the policy as responding to Jonathan Hall KC’s May 2025 recommendation for a State Threats Proscription like Power, while adapting the approach to reflect the legal and operational differences between terrorism and state threats.

The IA considers 4 main options: do nothing; introduce a State Threats Designation Power; replicate terrorist financing offences for state threats; and introduce a new civil recovery power for state threats.

The IA estimates a central net present social value (NPSV) of -£6.8 million over a 10-year appraisal period, with a range from -£5.5 million to -£10.5 million. The central estimate comprises £0.8 million in business familiarisation costs, -£1.4 million in Home Office staff costs and -£4.6 million in criminal justice system costs. The IA does not monetise the principal expected benefits, which include national security benefits, improved disruption and deterrence, operational efficiencies, reduced legal risk and avoided harms.

Rationale

Problem under consideration

The IA identifies the problem as the UK facing acute national security threats from states and state-linked bodies that seek to undermine and destabilise the UK. It explains that the National Security Act 2023 introduced important tools for countering foreign state threats, but does not provide a mechanism to designate state or state linked bodies and attach criminal consequences to association with them. The IA therefore presents the policy as addressing a gap in the legal framework for targeted disruption of the most egregious state threat actors. The IA uses a range of evidence to support the problem statement and explains why the existing terrorism proscription regime is not an adequate substitute.

The rationale would be strengthened by separating out more clearly: the underlying national security problem; the legal gap in existing legislation; and the operational constraints the preferred option is intended to resolve. The IA currently moves between these three issues, and the argument would be easier to follow if it set out explicitly which harms arise from state threat activity generally and which harms arise specifically from the absence of a designation mechanism.

Argument for intervention

The IA provides a sufficient argument for government intervention. It explains that only government can create a designation power, establish criminal offences and coordinate an intelligence-led response to state threats. It also explains that the preferred option would build on the National Security Act 2023 by creating additional routes to disrupt a designated body, prosecute relevant behaviour and deter individuals and businesses from engaging with bodies of acute national security concern.

The IA considers the consequences of not intervening. Under the do-nothing option, the government would continue to rely on the National Security Act 2023 and, where necessary, terrorism legislation. The IA states that this would leave a gap where the most egregious state-linked bodies cannot be disrupted through a targeted designation mechanism, increasing the risk of continued national security, economic and institutional harms.

The IA also draws on international comparators. It notes that the United States does not distinguish between state threats and terrorism in the same way as the UK and has designated some state bodies as Foreign Terrorist Organisations, while Australia has introduced legislation concerning state-sponsored terrorism.

Objectives and theory of change

The IA sets out the objective of protecting homeland security by making the UK a harder operating environment for state and state-linked bodies. It identifies intended outcomes including improved capability for law enforcement and intelligence agencies to disrupt state threat activity, increased public awareness of the power and designations, and reduced ability of designated bodies to operate in the UK.

The IA includes a theory of change and recognises the difficulty of measuring deterrence, particularly because there is no clear way of recording an absence of activity. This is an important acknowledgement in a policy area where the main benefits are expected to arise partly from avoided harms and behaviour that does not occur.

The objectives are relevant but would be strengthened by being framed directly around the intended outcomes, rather than around the broad aim of protecting homeland security. For example, the IA should specify which indicators will be used to assess improved disruption, improved prosecutorial effectiveness, increased awareness and reduced operational capability. It should also explain what level or direction of change would indicate that the power is operating as intended, while recognising that a full causal estimate may not be possible.

Identification of options

Identification of the ‘longlist’ of options

The IA identifies 4 options and discusses non-regulatory approaches. The 4 main options are: do nothing; introduce a State Threats Designation Power; replicate terrorist financing offences for state threats; and introduce a new civil recovery power for state threats. The IA assesses these options against critical success factors covering strategic fit, potential value for money, potential affordability and potential achievability.

The options section would be strengthened by explaining more clearly how the longlist was generated. The IA explains why each option was discounted or shortlisted, but it should set out upfront whether options were derived from Jonathan Hall KC’s recommendations, internal operational advice, international comparators, or stakeholder engagement. This would improve transparency and align more closely with the RPC expectation that the longlist generation process should be clearly described.

Justification for the shortlisted options

The IA shortlists the do-nothing baseline and the preferred State Threats Designation Power. It explains that the do-nothing option is retained as the business as-usual baseline and that the preferred option best addresses the identified legal and operational gap while remaining targeted and proportionate. Options 2 and 3 are rejected because they are considered too narrow and less disruptive than a designation power, and because they would not address the fundamental issue identified.

The IA would be improved by developing the comparison of the discounted options. Option 2 and option 3 are not fully costed, and the IA states that some costs were not fully explored. Given that the preferred option also has uncertain impacts and relies heavily on non-monetised benefits, the IA should explain more clearly why the broad direction of the trade-offs is sufficient to reject those alternatives without fuller appraisal.

The IA should also explain whether there were any variants of the preferred designation model considered, such as different offence scopes, different review mechanisms, or different thresholds for designation. The IA states that the preferred option will be implemented through primary legislation and individual secondary legislation designations, but more explanation of design choices would help demonstrate that the preferred route is proportionate.

Consideration of alternative options to regulation

The IA considers non-regulatory options and explains why they were rejected. It states that guidance, public communications and better use of existing powers would not create new legal or operational avenues for targeting bodies of concern, would not establish criminal offences, would rely on voluntary compliance and would not address the legal and operational gap identified.

This is sufficient, given the IA’s central rationale that the problem is a legal gap requiring a new statutory designation mechanism. The IA would nevertheless be strengthened by explaining whether any combination of non-regulatory measures and existing powers could achieve a “do minimum” approach, and why such an approach would not deliver enough additional disruption or deterrence relative to primary legislation.

Small and micro business assessment and medium sized business assessment

The IA provides a sufficient small and micro business assessment. It acknowledges that micro businesses are likely to face disproportionate familiarisation costs, since such costs do not scale with the size of the business.

It explains that small, micro and medium-sized businesses were considered for exemption as the default starting position, but that exemption was rejected because it would materially undermine the effectiveness of the regime and create opportunities for hostile actors to structure activity to fall below exemption thresholds. It also explains that smaller and newly established businesses may be used as intermediaries or service providers by foreign powers and state-linked proxy bodies.

The IA explains that national security and financial integrity regimes such as sanctions, counterterrorism financing and anti-money laundering frameworks do not exempt businesses on the basis of size, because risks are related to activity rather than organisational scale. It also recognises that smaller businesses may face proportionately higher familiarisation and reporting burdens because they may have fewer staff and less access to dedicated compliance functions.

The IA identifies mitigations, including clear guidance, targeted communications and reliance on existing reporting mechanisms. The small and micro business assessment would be strengthened by explaining how targeted communications will reach smaller firms in the most relevant sectors and whether the monitoring plan will separately assess impacts on small, micro and medium-sized businesses.

Justification for preferred way forward

Appraisal of the shortlisted options

The IA appraises the preferred option against the do-nothing baseline over a 10-year appraisal period. It estimates a central net present social value (NPSV) of -£6.8 million, with a range from -£5.5 million to -£10.5 million. The monetised costs comprise central estimates of -£0.8 million in business familiarisation costs, -£1.4 million in Home Office staff costs and £4.6 million in criminal justice system costs.

The business familiarisation estimate is based on expected guidance length, reading time and ONS salary data applied to a population of businesses based on the Foreign Influence Registration Scheme IA, with banks added. The low scenario includes only large organisations, the central scenario includes medium and large organisations, and the high scenario includes organisations from micro to large.

The IA notes that this is likely to overestimate the true scope because the designation power is narrower than FIRS and not all businesses will need to familiarise themselves in practice. The IA also notes that this guidance does not place a new regulatory burden on businesses.

The IA also considers potential Suspicious Activity Report and Defence Against Money Laundering (DAML) or Defence Against Terrorist Financing (DATF) administrative costs through sensitivity analysis, rather than incorporating them into the central monetised NPSV.

The RPC considers that the department should include these costs in the monetised NPSV, as these impacts do not appear to be materially more uncertain than other costs that the IA has monetised.

It assumes low, central and high numbers of businesses per designation and combines this with an internal Home Office assumption of 5 designations per year over the appraisal period and a half-day administrative burden per relevant request.

The resulting range is £30,000 to £3 million, with a central estimate of £300,000. Since businesses already submit DAML SARs under existing legislation, it would be helpful to benchmark the assumed unit cost against empirical evidence from business’s existing activities.

The criminal justice system costs are estimated using terrorism-related offences as proxies, specifically the proportion of section 11, 12 and 13 Terrorism Act 2000 offences in total TACT offences over different averaging periods. The IA states that Ministry of Justice outcomes data show 55 prosecutions and 52 convictions for those offences from June 2011 to June 2025. This is a reasonable proxy-based approach given the uncertainty, but the IA should explain why these offences are the best available proxies for expected use of the new state threats offences.

Selection of the preferred option

The preferred option is presented as proportionate because monetised costs (plus sensitivities) are relatively low and because the power would be targeted at bodies of acute national security concern. The IA recognises that designation decisions will need to consider the interests of businesses and does well to note that legitimate business activity could be reduced if businesses adopt an overly cautious approach to perceived links with designated bodies.

The IA would be strengthened by explaining how safeguards, guidance, review mechanisms and designation-specific secondary legislation will manage the balance between national security benefits and risks of over-compliance, chilled legitimate activity, and unintended impacts on trade or foreign policy objectives. The IA should also explain how future IA or analytical work will be undertaken for individual designations, especially where a designation may affect a larger business network or have more significant economic implications.

Regulatory scorecard

Part A

Impact on total welfare

The IA states that the overall impact of the preferred option is expected to be positive. It reports a negative monetised NPSV but explains that the overall impact is expected to be positive because of substantial non-monetised benefits relating to public safety, national security, operational effectiveness, deterrence and reduced legal risk.

The scorecard would be improved by presenting the components of the monetised NPSV more clearly and ensuring consistent terminology. It should also present the central and range estimates in a concise table that distinguishes business familiarisation costs, Home Office staff costs, CJS costs and sensitivity estimates for SAR/DAML/DATF costs.

The scorecard states that no significant or adverse distributional impacts are expected. Given the national security nature of the measure, this may be reasonable, but the IA should explain whether any sectors, business sizes or communities may be more exposed to compliance burdens, over-compliance risks or indirect effects following specific designations.

Impacts on business

The scorecard identifies the main business impacts as familiarisation costs and potential administrative costs associated with SAR and DAML/DATF submissions where relevant. It estimates a business NPV range between -£0.2 million and -£3.2 million, with a central estimate of -£0.8 million. It also identifies non-monetised business benefits, including reduced risk of law-breaking and reputational damage from dealing with designated bodies, and non-monetised costs, including potential over-compliance and reduced legitimate activity.

The business section should report the EANDCB clearly and explain which impacts are treated as direct and included in that metric, particularly since it previously treated DAML submission costs as a sensitivity.

Impacts on households, individuals or consumers

The IA states that there are no significant direct financial impacts on households and identifies non-monetised indirect benefits from improved public safety, reduced economic disruption, and protection of employment and incomes through reduced exposure to state threat activity.

Part B

The scorecard assesses the impact on the business environment as uncertain. It recognises that the measure imposes some familiarisation and potential administrative costs, but may also support a safer business environment and improve the attractiveness of the UK business environment. It also recognises the risk of a chilling effect on economic partnerships due to greater caution in engaging with unknown or new partners.

The trade and investment assessment states that designation decisions could have detrimental effects on foreign policy objectives but that these will likely be factored into designation decisions and are not expected to significantly affect international trade. The IA would benefit from explaining whether trade and investment impacts will be considered at the point of individual designation, because impacts are likely to depend on the nature of the body designated and its business relationships.

The natural capital and decarbonisation assessment states that no environmental impact is expected.

Monitoring and evaluation

The IA sets out a satisfactory monitoring and evaluation plan. It identifies evaluation questions covering the extent to which the power contributes to disruption and deterrence, improves operational effectiveness, reduces the operational capability of designated bodies, and generates unintended consequences for the UK business environment or smaller businesses.

The plan proposes a mixed-methods approach, including process evaluation, impact evaluation and case studies of individual designations. It identifies outputs, short term outcomes and long-term outcomes and impacts, including the number and type of designations, operational use of powers, charges and convictions, guidance, training and communications activity, increased awareness, behavioural change, improved disruption and enforcement activity, and reduced harm from state threats.

The IA describes broad relevant data sources, including law enforcement and intelligence agencies, the Home Office casework function, the National Crime Agency, the Crown Prosecution Service and other relevant sources. It would do better to identify specific existing data sets and assess whether there are any ‘gaps’ that need to be filled with new data collection, for the monitoring and evaluation plan to be effective. It also states that monitoring and evaluation governance will sit with the Home Office, supported by a dedicated casework function and cross-government partner input, and that the Independent Reviewer of State Threats Legislation is expected to provide external scrutiny.

The department states that a post implementation review (PIR) will be completed before the end of Parliament in 2029. The IA would be strengthened by explaining the rationale for the 2029 review point, particularly whether there will be enough designations, operational uses, prosecutions or behavioural evidence by then to assess effectiveness. The IA should also explain how development of the 2029 PIR will be coordinated with any review or evaluation activity associated with the National Security Act 2023.

The monitoring and evaluation plan should also specify baselines, metrics, data owners, collection frequency and review triggers. In particular, it should identify how the Home Office will monitor business familiarisation costs, SAR/DAML/DATF activity linked to designations, over-compliance, chilled legitimate activity, impacts on small and micro businesses, displacement of activity and changes in the behaviour of designated bodies or proxies.