Most large economies now review foreign acquisitions of businesses that matter for national security, and many make filing mandatory before completion. The triggers differ: the UK looks at 17 sensitive sectors and share thresholds whatever the buyer's nationality, the US reviews deals mainly through a largely voluntary CFIUS process with mandatory cases, Germany reviews non-EU stakes from 10%, and India and Saudi Arabia control foreign entry through approval routes and lists. A deal that misses a mandatory filing can be void or suspended, so screening has to be mapped before signing.
Mandatory filing regimes: the UK and the US
The UK National Security and Investment Act 2021 requires government approval before completion of acquisitions of entities active in 17 sensitive areas, including defence, energy and transport. It applies whatever the acquirer's nationality, including UK buyers, and has no turnover threshold. Notification is triggered when a holding of shares or votes crosses 25%, 50% or 75%, or when voting rights let the buyer pass or block any class of resolution. A notifiable deal completed without approval is void, and civil penalties can reach 5% of worldwide turnover or £10 million, whichever is greater. In March 2026 the government announced changes to the sector definitions, including narrower artificial intelligence and communications schedules, to be made by secondary legislation; deal teams should check which definitions are in force on the signing date.
In the United States, the Committee on Foreign Investment in the United States (CFIUS) reviews covered transactions for national security risk. Filing is largely voluntary, but a declaration is mandatory at least 30 days before completion in two cases: where a foreign person acquires a substantial interest in a US business dealing in critical technology, critical infrastructure or sensitive personal data (a TID business) and a single foreign government has a substantial interest in that foreign person, or where the US business deals in critical technologies that would need a US export authorisation for the relevant foreign investors.123456
Germany and the new EU framework
Germany's Foreign Trade and Payments Ordinance applies to acquirers from outside the EU. A direct or indirect voting share triggers review at 10% in the most sensitive categories (such as critical infrastructure operators), at 20% in the other listed categories, and at 25% for any other German company. For the listed categories, which include cloud services, artificial intelligence, semiconductors and critical raw materials, the acquirer must notify the federal economics ministry without undue delay after signing.
At EU level, Regulation (EU) 2026/1386 repeals the 2019 screening framework and takes effect on 17 January 2028. A secondary summary reports that it will require every Member State to maintain a screening mechanism covering minimum sensitive sectors. Until then, national regimes such as Germany's and France's apply on their own terms, and deals signed in 2027 with long timetables should be checked against both sets of rules.789
India and Saudi Arabia: entry routes and activity lists
India screens by investor origin rather than by deal. Under Press Note 3 of 2020, an entity of a country sharing a land border with India, or an investment whose beneficial owner is linked to such a country, may invest only with government approval, and a later transfer that brings ownership into that category also needs approval. In March 2026 the Cabinet allowed investors whose beneficial ownership from those countries is non-controlling and no more than 10% to use the automatic route, subject to sectoral caps and conditions.
Saudi Arabia's Investment Law replaced foreign investment licensing with registration with the Ministry of Investment, but a foreign investor still needs the Ministry's approval before engaging in any activity on the published List of Excluded Activities. Saudi Arabia therefore works less like a deal-by-deal security review and more like an entry list: the first question is whether the target's activities appear on it.101112
| Market | Regime | Trigger | Effect of not obtaining approval | Source |
|---|---|---|---|---|
| United Kingdom | National Security and Investment Act 2021 | 17 mandatory sectors; holdings crossing 25%, 50% or 75%; any nationality | Deal void; civil penalty up to 5% of worldwide turnover or £10 million | GOV.UK NSI Act guidance |
| United States (federal) | CFIUS, 31 CFR Part 800 | Largely voluntary; mandatory declaration for certain TID deals at least 30 days before completion | Penalties not confirmed | cfius.gov; eCFR 800.401 |
| Germany | Foreign Trade and Payments Ordinance (AWV) | Non-EU acquirer reaching 10%, 20% or 25% of votes depending on sector | Notification duty after signing for listed sectors | gesetze-im-internet.de, AWV 55a and 56 |
| India (central) | Press Note 3 (2020), as relaxed in 2026 | Investor or beneficial owner linked to a land-border country; up to 10% non-controlling may use automatic route | Government-route approval needed | FIFP FDI FAQ; PMIndia |
| Saudi Arabia | Investment Law | Activity on the List of Excluded Activities | Ministry of Investment approval needed | MISA, Investment Law |
| European Union | Regulation (EU) 2026/1386 | Minimum national screening mechanisms (from 17 January 2028) | Applies through national laws | EUR-Lex |
Decisions to make
- Does any group company carry on activities inside the UK mandatory sectors, the German listed categories or the US TID definitions?186Mandatory filing depends on what the target does, not on the size of the deal, and the UK applies even to domestic buyers.
- What exactly will the investor acquire: percentage of votes, board seats, vetoes and information rights?2711The UK and Germany use share and voting thresholds, and India's 2026 exception depends on a non-controlling stake of no more than 10%.
- Who are the investor's ultimate beneficial owners, and is any foreign government among them?106India's rule turns on beneficial owners linked to land-border countries, and a foreign government's substantial interest can make a CFIUS declaration mandatory.
- Does the timetable allow for approval before completion, with clearance as a condition precedent?36A UK notifiable deal completed without approval is void, and a US mandatory declaration must be filed at least 30 days before completion.
- Will completion fall after 17 January 2028, when the new EU regulation takes effect?9Member States must align their regimes with the new regulation, which may change filing triggers in EU target countries.
Documents usually needed
- Ownership chart of the investor up to ultimate beneficial owners, with nationality and any state shareholdings
- Description of each target entity's products, services, customers and technology, including export control classifications
- Share purchase or subscription agreement with regulatory conditions precedent and long-stop date
- Shareholders' agreement or term sheet showing board, veto and information rights
- List of government contracts, security clearances and critical infrastructure functions of the target
Common mistakes
- Assuming screening only applies to buyers from particular countries, when the UK regime covers all acquirers including UK ones
- Treating a minority stake as safe: Germany reviews from 10% in the most sensitive sectors
- Signing and completing simultaneously in a deal that needs a mandatory filing
- Checking only the immediate investor and not indirect beneficial owners linked to India's land-border countries
- Relying on the new EU regulation before 17 January 2028, or ignoring it for deals that will complete after that date
Questions businesses ask
Does the UK regime apply if the buyer is British?
Yes. Mandatory notification under the National Security and Investment Act applies regardless of the acquirer's nationality.1
Is a CFIUS filing always required for a foreign investment in a US company?
No. Filing is largely voluntary, but a declaration is mandatory in defined cases involving TID businesses, foreign government interests or critical technologies that would need export authorisation.56
Can an investor with some Chinese beneficial ownership invest in India without approval?
Since the 2026 change, where the land-border beneficial ownership is non-controlling and no more than 10%, the automatic route is available subject to sectoral caps and conditions. Above that, government approval is needed.1011
What this guide does not yet confirm
These points need checking with a qualified local professional before you rely on them.
- CFIUS penalties for failing to file a mandatory declaration, and the investigation-phase timetable, were not confirmed.
- The UK statutory instrument revising the 17 mandatory sectors had not been found on legislation.gov.uk when the source claim was checked; the current sector list must be confirmed at signing.
- The operative articles of Regulation (EU) 2026/1386 could not yet be checked on EUR-Lex; its minimum scope comes from a secondary summary.
- The text of India's Press Note 2 (2026 Series) and the amending FEMA rules could not yet be checked.
- The contents of Saudi Arabia's List of Excluded Activities were not reviewed.
- France, Singapore and UAE screening regimes are covered in the market guides and were not compared in detail here.
Sources and review status
Each statement is numbered to the source it was checked against. We use official sources where we can, and each statement says whether it was checked against an official or a secondary source. Sources last checked on 19 October 2026. None of it has been professionally reviewed yet: it is research checked against official and secondary sources by WONE Global, not legal or tax advice.
Acquisitions of certain entities active in 17 sensitive areas of the economy, including defence, energy and transport, must be notified to and approved by the government before completion under the National Security and Investment Act 2021. Applies regardless of the acquirer's nationality, including UK acquirers. There is no turnover threshold.
Mandatory notification is triggered by acquiring shares or votes that take a holding from 25% or less to more than 25%, from 50% or less to more than 50%, or from less than 75% to 75% or more, or voting rights that allow the acquirer to secure or prevent any class of resolution. Material influence and acquisitions of assets (land, tangible movable property, intellectual property) are not mandatory but can be notified voluntarily or called in.
A notifiable acquisition completed without approval under the National Security and Investment Act 2021 is void, and civil penalties can reach 5% of worldwide turnover or £10 million, whichever is greater. Criminal penalties also apply. Retrospective validation can be sought.
Following consultation, the government announced on 12 March 2026 that it will change the mandatory sectors, including a new water sector, separate critical minerals and semiconductors schedules, and narrower artificial intelligence and communications definitions, by secondary legislation to be laid later in 2026. Not yet in force as checked: no amending regulations were found on legislation.gov.uk.
A title search of legislation.gov.uk for 2026 regulations on notifiable acquisitions returned no results on 18 October 2026; recheck before relying on the current 17-sector list.
CFIUS, chaired by the Secretary of the Treasury, reviews covered transactions for national security risk; filing is largely voluntary but a declaration is mandatory for certain transactions in which a foreign government acquires a substantial interest and certain transactions involving critical technologies. Federal. Mandatory declaration rules at 31 C.F.R. 800.401, introduced under FIRRMA; statutory basis is section 721 of the Defense Production Act of 1950. Detail is covered in the transactions area.
A declaration to CFIUS is mandatory, at least 30 days before completion, where a foreign person acquires a substantial interest in a TID US business and a single foreign government has a substantial interest in that foreign person, or where a TID US business deals in critical technologies that would need a US export authorisation for the relevant foreign investors. Federal (31 CFR Part 800). TID means critical technology, critical infrastructure or sensitive personal data businesses. Exceptions include excepted investors and certain US-managed funds. A full notice may be filed instead of a declaration.
The eCFR is an authoritative but unofficial editorial compilation; the official text is the annual CFR edition and Federal Register.
Under the Foreign Trade and Payments Ordinance (AWV), a non-EU acquirer's direct or indirect voting share in a German company triggers cross-sector investment review at 10% for the most sensitive categories in § 55a(1) nos. 1–7, 20% for categories nos. 8–27, and 25% for all other companies. Further acquisitions are reviewable when the holding reaches 20%, 25%, 40%, 50% or 75% (depending on category). Atypical control through board seats, vetoes or information rights is treated as reaching the threshold.
A non-EU acquirer must notify the Federal Ministry for Economic Affairs without undue delay after signing a contract to acquire a qualifying stake in a German company in one of the sensitive categories listed in § 55a(1) AWV (for example critical infrastructure, cloud services, AI, semiconductors, critical raw materials). Obligation lies with the direct acquirer. For public takeover offers, notification follows publication of the decision to make an offer. The ordinance text names the BMWK; the ministry is now the Bundesministerium für Wirtschaft und Energie.
Regulation (EU) 2026/1386 of 17 June 2026 on the screening of foreign investments in the Union repeals Regulation (EU) 2019/452, and EUR-Lex records 17 January 2028 as its date of effect. EU-wide. Until it applies, the 2019 framework and each Member State's national screening law continue to govern. A secondary summary (Herbert Smith Freehills Kramer, July 2026) reports publication in the Official Journal on 26 June 2026, entry into force on 16 July 2026, full application from 17 January 2028, and a requirement for every Member State to maintain a screening mechanism covering minimum sensitive sectors such as defence and dual-use items, semiconductors, quantum technologies, artificial intelligence, energy, transport and digital infrastructure, critical raw materials and financial entities.
Only the title and metadata were readable on EUR-Lex; the operative articles (minimum scope, mandatory notification, cooperation mechanism) could not yet be checked and are taken from the secondary summary.
An entity of a country sharing a land border with India, or an investment whose beneficial owner is linked to such a country, can invest only under the government route, and a later transfer that brings beneficial ownership within this category also needs government approval. Press Note 3 (2020 Series) dated 17 April 2020, as revised in 2026; subject to the 10% non-controlling exception in in-establish-004. Central rule.
The FAQ uses the 2020 wording (beneficial owner situated in or a citizen of such a country). Secondary sources report that Press Note 2 (2026 Series) dated 15 March 2026 removed the 'situated in' limb so the test now turns on citizens and entities of those countries; the official Press Note text could not yet be checked.
Investors whose beneficial ownership from land-border countries is non-controlling and no more than 10% may invest under the automatic route, subject to sectoral caps, entry routes and conditions, with the investee reporting the relevant details to DPIIT. Beneficial ownership is defined using the criteria of the Prevention of Money-laundering Rules, 2005 and tested at the level of the investor entity. Central rule.
Cabinet decision dated 10 March 2026. Secondary sources report implementation through Press Note 2 (2026 Series) and an amendment to the FEMA (Non-debt Instruments) Rules notified on 2 May 2026; the gazette notification could not yet be checked.
A foreign investor must obtain Ministry of Investment approval before engaging in any activity included in the List of Excluded Activities, which the competent authority issues and the Ministry publishes. Applies only to activities on the published List of Excluded Activities.
Questions on this topic
12 statements on foreign investment screening
