New UK national security rules – What do they mean for life science investments?

The National Security and Investment Act 2021 (NSI Act) comes into force on 4 January 2022. From then, the UK Government will be empowered to call in for review any qualifying acquisition which may give rise to UK national security concerns. The NSI Act captures acquisitions of any size, including in certain cases where minority shares are acquired, and applies also to non-UK entities provided there is a connection to the UK.

On 15 November, the Government released its guidance on which acquisitions will be notifiable under the NSI Act. Acquisitions of entities in 17 sensitive areas of the economy will require notification to the Government and may not be completed before the Government has cleared them.

In this post, we focus specifically on the impact of the NSI Act on M&A in the life sciences sector. Certain technologies developed by for instance medical device manufacturers, MedTech companies and biotech firms may be among the 17 sensitive areas, and an acquisition of a company that develops or produces such a technology will be notifiable if certain conditions are met.

Short overview of the NSI Act

The NSI Act applies to any acquisition of an entity or asset (including IP) provided the level of control acquired over that entity or asset passes a certain threshold. If the Government reasonably suspects that an acquisition meets these criteria and that it has given or may give rise to a risk to national security, it can call the deal in for scrutiny. It can do so with acquisitions going back to 12 November 2020. The ‘reasonably suspects’ threshold is known to be a low threshold in legislative drafting, and it gives the Government a wide margin of discretion to call acquisitions in.

The entity or asset does not need to be based in the UK; it is sufficient that it has a connection to the UK. For entities, this is the case if they carry on activities in the UK or supply goods or services to people in the UK. Assets have a UK connection if they are used in connection with activities carried out in the UK or in connection with the supply of goods or services to people in the UK.

For the NSI Act to apply, the transaction must lead to the acquisition of control over the entity or asset. That is the case if:

• The acquisition of shareholding stake or voting rights in the entity meets or crosses certain percentage thresholds (this applies if the shareholding crosses the 25%, 50% or 75% threshold – Hence, if e.g. a 30% stake is acquired this acquisition is a qualifying acquisition, and if the shareholding is subsequently expanded to more than 50% this is another qualifying acquisition).
• The acquisition of voting rights allows the passing or blocking of resolutions governing the entity’s affairs.
• The acquirer will be able to materially influence the policy of the entity. The Government explicitly refers to the CMA’s guidance on its assessment of material influence in the context of merger control.
• The acquirer will be able to use the asset, or will be “able to do so more than [it] could prior to the acquisition”.

Even corporate intra-group restructures may qualify, which where the NSI Act departs from the existing rules in merger control. According to the Government, even if the ultimate owner remains the same but a former sister company of the qualifying entity becomes its interim holding company, this means “ownership now goes through a different corporate chain” and “there has been a change of control under the NSI Act … even though the ultimate owner remains the same”.

Timing-wise, the Government can call a potential qualifying acquisition in before and after it is closed. Before closing, the potential acquisition can be called in at an early stage, when it is only “in contemplation”. The Government itself gives the example of companies having signed heads of terms as sufficient for the transaction being in contemplation.

Mandatory and voluntary notification

Acquirers cannot wait for the Government to call the acquisition in if they are contemplating a qualifying acquisition of an entity that has activities in the UK within 17 sensitive areas of the economy. If that is the case, the acquirer will be legally required to notify the Government. The Secretary of State for Business has set out which activities fall within the 17 sensitive areas in draft regulations. They include inter alia advanced robotics, artificial intelligence, data infrastructure, quantum technologies and synthetic biology. N.B.: the activity must be carried out in the UK for the acquisition to be notifiable. Therefore, a ‘foreign to foreign’ transaction may be notifiable if the entity being acquired carries out an activity within one of the 17 areas and does so in the UK.

If the acquisition is notifiable, it must not be completed before the Government approves it. The acquisition is legally void if it is completed without notifying and gaining approval from the Government. Failure to notify may also attract civil and criminal penalties. The civil penalty may amount to 5% of the organisation’s turnover or £10 million, whichever is greater. The Government will allow acquirers to apply for retrospective validation of notifiable acquisitions that were not notified.

Qualifying acquisitions that do not involve an entity that has UK activities in one of the 17 areas of the economy can still be called in for a national security assessment if the Government reasonably suspects that it may give rise to a national security risk. The Government can do so up to 5 years after the acquisition has taken place and up to 6 months after becoming aware of it if it has not been notified.

Acquirers who consider that their non-notifiable acquisition is at risk of being called in or who want to eliminate any risks in this respect can submit a voluntary notification both before and after completion of the acquisition.

The Government’s assessment

The regime has a ‘review period’ and an ‘assessment period’, each lasting up to 30 working days, though the assessment period can be extended by an additional period of 45 working days. It can only be further extended with written agreement of the acquirer. Transactions that are not notifiable but are ‘called in’ go straight to the assessment period for a full national security assessment. Acquisitions that are notified (either under the mandatory notification rules or voluntarily) first go through the review period, after which they are either cleared or called in for a full national security assessment.

By the 30^th working day of the assessment period, the Government will reach one of four decisions: (i) clearance; (ii) clearance subject to conditions; (iii) acquisition is blocked and cannot proceed; or (iv) extension of the assessment period by another 45 working days.

The guidance issued on 15 November 2021: clarity as to the 17 areas of the economy

The guidance issued on 15 November 2021 clarifies how the Government will determine whether an activity falls within one of the 17 areas of the economy with respect to which notification will be mandatory. For companies looking to make acquisitions of healthcare or life science companies, the most obvious area to check is synthetic biology. However, medical devices, pharmaceuticals and other healthcare technologies may come under the scope of other areas.

Synthetic biology is defined in the draft regulations as the process of applying engineering principles to biology to design, redesign or make biological components or systems that do not exist in the natural world. It includes technologies like gene-editing and gene therapy, the use of DNA for data storage, encryption, and bio-enabled computing, and the design and engineering of biological-based parts of enzymes, genetic circuits and cells, and novel devices and systems.

The Government is concerned about the dual-use potential of synthetic biology, which may have beneficial civilian purposes, but may under certain circumstances also be deployed in ways which present a national security concern if it ends up in the wrong hands. Consistent with this concern, the development of human and veterinary medicines that employ synthetic biology at any stage of development or production is exempt from the notification requirement, but not if the synthetic biology technology could be employed or modified to produce and/or deliver toxic chemicals to achieve an incapacitating or lethal effect, or uses materials, substances or pathogens set out in the Anti-terrorism Crime and Security Act 2001.

Out of the remaining 16 areas of the economy, it will be important for life science investors to consider whether the target they are acquiring may be active in the development of technologies that the Government would consider to be ‘sensitive’. This can include for example:

• Advanced materials: the research, development or production of advanced materials would be in scope, and this includes for example photonic and optoelectronic materials (to name one example, fibre Bragg gratings (listed in the draft regulations) are used in surgical tools, assistive devices, wearables and biosensors).
• Advanced robotics: companies that develop robotics for healthcare purposes may come within the scope of the NSI Act, for example if they develop core components of advanced robotics, e.g. sensors which give advanced robotics the ability to accurately sense their environment, the objects around them or their own position, as well as end-effectors such as grippers, manipulator arms etc.
• Artificial intelligence (AI): the guidance applies a two-step process to assess whether the entity is in scope of the NSI Act. First, the acquirer should confirm that the target entity uses AI in its research, development or production. Second, if the entity does fit the definition of AI, the acquirer should ascertain how it is being applied. Three categories of application are in scope of the new rules: identification or tracking, advanced robotics or cyber security. It should be noted that identification includes audio and speech recognition, emotion recognition and gait analysis. These identification methods have security uses, which is why they are included, but firms are also working on using AI for voice and gait analysis in a medical context (neurodegenerative diseases like Parkinson’s can for example manifest themselves through gait).

More case-specific instances may arise too. For instance, the guidance gives an example in relation to quantum technologies that could be applicable in a life sciences context. The example involves a Company A, a bank, which employs the services of Company B, a quantum company, to explore the use of quantum computing technology to improve its operations. Company A has an in-house team that is tasked with developing an algorithm to run on a quantum computer to help speed up financial trading. If Company C acquires Company A at a future date, it would be required to notify the Government, as Company A has played a role in the development of a quantum technology (namely quantum algorithms that enable the functionality of the overall system). One can see how the bank in the example can be replaced by a MedTech firm that develops such an algorithm, in which case acquisition of that firm would be notifiable.

Other target companies may be suppliers to the Ministry of Defence, which would almost always be in scope (even if they provide a non-defence service like catering). There are also notification requirements for businesses who write code that controls how computer processing units function, data centre and cloud storage operators, and entities that develop technologies that use cryptographic authentication.

Takeaways

Determining whether the target of an acquisition is active in one of the 17 areas of the economy will be a complex exercise, involving a detailed review of the target’s business against the regulations, the guidance and in some instances the UK’s Strategic Export Control List (SECL).

National security screening is fast becoming an additional area of focus for dealmakers. In practice, the rules will be complex to navigate, and the consequences of failing to notify can be severe. It will therefore be key to include a review of possible national security requirements early on in transactions that could involve sensitive sectors, and to map out an effective strategy to obtain clearance as soon as possible where that is the case.

To get updates straight to your inbox, enter your email on the homepage.

[Stijn Huijts is a partner at Geradin Partners. He previously worked at the Competition and Markets Authority, where he frequently worked with the Government Department (BEIS) that has developed the national security rules. Photo: unsplash.com]