Competition and EU Law | Norwegian Government Proposes Regulation on Investment Control Notification Regime under the Norwegian Security Act

On 21 February 2025, the Ministry of Justice and Public Security published a proposal for a Regulation on ownership control with investments under the National Security Act (“NSA”). The proposed Regulation will clarify and supplement the comprehensive amendments of the notification regime under the NSA adopted by the Parliament in June 2023, but not yet in force. It is expected that both the adopted amendments in Chapter 10 of the NSA and the proposed Regulation will enter into force during 2025.

In a nutshell – the existing and coming notification regime under the NSA

Under the current NSA, the provisions of the Act concerning investment control apply to all entities that have been subjected to the NSA by an individual decision under Section 1-3 of the NSA, because they hold decisive or significant importance for fundamental national functions or national security interests. This means that there are no pre-defined categories of companies, absent such a decision, that will trigger a mandatory FDI notification requirement. Notification is currently only required for acquisition of a “qualified ownership interests” (one third or more of the shares, share capital or voting rights or “significant influence in some other way”). It should be noted that the investment control under the NSA applies to both Norwegian and foreign investments. The addressee of a notification is the Ministry responsible for the sector in which the target company is active, and for companies not covered by the responsibility of any ministry, the National Security Authority (“the relevant Authority”).

The adopted amendments that have not yet entered into force will:

Broaden the scope of businesses that will be subject to the notification provisions, as the notification requirement will apply automatically to all entities that hold a supplier clearance under the NSA (a supplier clearance is mandatory for all suppliers who participate in procurements which may necessitate access for the supplier to information classified under the Act as confidential, secret or top secret, cf. NSA Section 5-3).

Lower the threshold for when a notification under the NSA must be submitted to 10 percent of the share capital or voting rights in a company. Additionally, subsequent acquisitions which causes the ownership interest to equal or exceed 20 percent, one third, 50 percent or 90 percent will trigger additional notification obligations when each subsequent threshold is passed. Ownership interests are calculated at group level, including persons or companies closely related to the acquirer.

The existing notification threshold of acquisition of “significant influence in some other way” will apply as a separate threshold triggering filing also after the amendments enter into force.

Introduce a standstill obligation, with no automatic clearance if the relevant Authority has not given approval within the 60 working days deadline.

Introduce a broad prohibition on the exchange of information which may be used to perform activities that may threaten Norwegian national security, until the relevant Authority has approved the implementation of the transaction (exemption may be requested).

Expand the scope of the notification obligation to also rest with the target and the seller where the investment is directly into the legal entity subject to the NSA (under the applicable rules, the duty to notify rests solely with the acquirer). However, it will be sufficient that one of the parties under a filing obligation notifies the acquisition to the relevant Authority. For indirect investments, the filing obligation rests solely with the acquirer.

Enable the National Security Authority to impose fines on the party/parties which have the obligation to notify, for negligent or intentional failures to notify a transaction triggering a notification obligation (under the current Act, only breaches of other provisions in the Act unrelated to investment control may be sanctioned).

Key Elements of the Proposed Regulation

Firstly, the proposed Regulation sets out the requirements for the content of the notification. The proposed Regulation includes an extensive list of requirements and gives the National Security Authority the possibility to prepare a standard notification form. The relevant Authority may request supplementary information necessary for its assessment, which will “stop the clock”.

Secondly, the proposal sets out the elements to be considered in the relevant Authority’s assessment of whether the material condition for prohibition of the investment is fulfilled (non-unsubstantial risk of basic national functions or national security interest being threatened). These elements cover a broad range of notions concerning the business such as vulnerabilities, potential risk-threatening activity that may occur and the likelihood and consequences of such activity, as well as the importance of the business for other companies and the acquirer’s connection to the authorities of other countries.

Thirdly, the proposed Regulation sets an upper limit for the imposition of fines for breaches of the notification requirement and standstill obligation. The Ministry proposes two alternative thresholds which will apply in parallel: 25 times the “G” (National Insurance scheme basic amount), which is increased annually (25 times G would per 1 January 2025 equal approx. NOK 3.1 million), or four percent of the entity’s total annual turnover in the preceding financial year. While the wording of the amended Act indicates that all parties that are under a notification obligation is under risk of fines, the Ministry in the proposal states that fines for breach of the notification obligation is only applicable to entities subject to the Act by individual decision or by holding a supplier clearance for classified procurement, i.e. only the target. This casts doubt over whether the acquirer and/or seller will risk fines for breach of the notification obligation.

For the alternative based on turnover, the Ministry’s proposal does not specifically address if the turnover is that of the legal entity or the entire group of which the entity is part. The Ministry states that the “25 times the G”-alternative will be applicable where the business has little or no turnover due to “corporate structural measures”. This seems to indicate that that fines based on turnover will be calculated based on the specific entity’s annual turnover, not the group.

Fourthly, the proposal details the scope of the coming ban on information exchange in the Act. The ban will apply also before a notification is submitted. The ban is wide-ranging in scope. The proposal lists certain elements of importance to national security interests, such as employees, customers, supplier, technology and knowledge, as well as technical information including information systems, infrastructure, production methods and operation, and related protection and security measures. A notifying party may request an exemption from the relevant Authority and the Regulation will detail how the relevant Authority will consider the request. The relevant Authority may approve a request on conditions such as restrictions on access to the information or use of neutral third-party advisors to receive and handle the information on the acquirer’s behalf.

Fifthly, the Regulation does not directly address whether internal restructuring in a group will trigger a notification obligation under the amended rules of the Act. Under the current Act, internal restructurings do not trigger a filing obligation. Under the amended Act, a technicality in the wording of the Act has introduced some uncertainty concerning whether internal restructuring will continue to be exempted.

Sixthly, the proposed Regulation sets out to provide more details on the notification requirement for acquisitions of “significant influence in some other way”. The provision is stated to be inspired by the Norwegian Competition Act Section 17 third paragraph that specifies the requirements of control, and that control can be acquired both directly and indirectly. Under the proposed Regulation, an overall assessment must be made of the influence acquired, including of a non-exhaustive list of elements. These elements include, in addition to appointment of board members and voting rights, the possibility to influence through ownership and sale of property rights, assets and rights of use, to influence on the management, operation and development of the business such as through access to buildings, systems or infrastructure, on service, supplier and maintenance agreements, on research and development, and the possibility to influence by other means or through other relationships. The requirement for an overall assessment entail that a notification will be required for acquisitions below 10 percent of the shares, share capital or voting rights, if the acquirer gains a “qualified” influence. This appears to be a catch-all provision for any kind of qualified influence in other ways. It clearly includes de facto control over the target. However, it is unclear to what extent influence that would not be considered de facto control, could trigger a filing obligation. Depending on the specific circumstances, it cannot be excluded that e.g. purchasing property or assets alone, or getting the right to appoint a board member, in a situation where few or no shares are acquired, may trigger the notification obligation. The National Security Authority will publish guidance.

Process

The deadline for submitting responses to the proposal is set for 23 May 2025. After that, it is expected that the government will enact the final version of the Regulation as well as decide on the enter into force of the noted amendments in the Act at some point during 2025.

BAHR’s Perspective

The coming enter into force of amendments concerning investment control and the proposed Regulation is expected to have a substantial impact, especially on entities operating within sectors that are crucial to national security. Businesses intending to acquire stakes in companies relevant to national security should be prepared to include in their due diligence procedures questions on whether the target has interests in Norwegian companies that are subjected to the NSA’s investment control rules either by individual decision or by holding a supplier clearance, and whether there is a risk that the investment will be prohibited. However, one must take care not to violate the far-reaching ban on information exchange and, if necessary, be prepared to submit requests for exemptions and possibly solicit third party advisors to handle the information. Businesses should also be prepared to provide comprehensive information in the notification about the acquisition, including details about the ownership structure, financing and any foreign interests associated with the acquisition.

From a Norwegian perspective, this proposal is a part of a broader trend towards stricter control of foreign investments, in line with international developments such as EU’s Screening Regulation. In December 2023, a government appointed committee published the report NOU 2023: 28 Investment control – An open economy in uncertain times. The report points to, among other things, the business community’s need for more predictable rules and that international cooperation is a key element in the work on security-threatening economic activity. The government has confirmed that it is working on a proposal for an Investment Control Act, which would entail a generally applicable FDI regime in Norway, resulting in two parallel regulations of investment control applicable for Norwegian entities.

BAHR will closely monitor the development of this proposal and assist our clients in navigating the new requirements, and will continue to provide updates on relevant investment control legislation and regulations.