Norwegian government proposes comprehensive amendments to the national security act

On 31 March 2023 the Norwegian Government proposed comprehensive amendments to the Norwegian national security act. If passed by Parliament, the proposal would significantly broaden the scope of the Norwegian FDI notification regime. Read below for an executive summary of the most important amendments contained in the new proposal.

Increased number of businesses are likely to become subject to the FDI notification obligation

Under the current Norwegian National Security Act, last updated in 2019, the provisions of the Act apply for state and municipal entities and suppliers of goods or services related to classified procurements. In addition, the Norwegian state may issue individual decisions to subject companies to the provisions of the act, provided the target company either (i) processes classified information, (ii) has access to or possesses information, information systems, objects or infrastructure of decisive importance for fundamental national functions or (iii) performs activity of decisive importance for fundamental national functions.

The provisions of the National Security Act mandating FDI notifications for certain transactions only apply to companies which have been subjected to the National Security Act by way of an individual decision, meaning that there are no pre-defined categories of companies or transactions which would, absent such a decision, trigger a mandatory FDI notification requirement.

In its proposal, the government has proposed that the FDI notification provisions of the Act should apply automatically to all entities which holds a supplier clearance under the rules of the Act. A supplier clearance is mandatory for all suppliers who participate in procurements which may necessitate access by the supplier to information classified under the act as CONFIDENTIAL or above. Approximately 60-70 businesses currently holds such clearance, according to the Government.

In addition, the Government has proposed to revise the threshold for companies which may be subjected to the FDI notification requirement of the Act through an individual decision. Under the new rules, each sectoral department and the National Security Authority will be required, and not only empowered, to subject companies of decisive importance for fundamental functions or national security interests to the application of the national security act. Furthermore, the authorities may, at their discretion, subject companies of significant importance for fundamental national functions or national security interests to the application of the National Security Act.

The Government has estimated that between 250 and 300 companies are of significant importance for fundamental national functions or national security interests and may therefore become subject to the provisions of the National Security Act. As the Government in its proposal stresses that these companies should only be subjected in whole or in part to the National Security Act where necessary, it remains to be seen how many additional companies will become subject to the Norwegian FDI regime.

Significantly lowered thresholds

Under the current National Security Act, an acquisition of over one third of the share capital or voting shares in a company, or the acquisition of a “significant influence” over the target company, could trigger an FDI notification obligation.

The Government has proposed to significantly lower the thresholds for when an FDI notification obligation may arise. Under the proposed rules, a mandatory FDI notification obligation may arise for acquisitions of only 10 percent of the share capital or voting shares in a company. Subsequent acquisitions of shares which causes the ownership interest to equal or exceed 20 percent, one third, 50 percent or 90 percent will trigger additional notification obligations when each subsequent threshold is passed.

As under the current rules, an acquisition of a shareholding which confers a “significant influence” will continue to give rise to a notification obligation. Acquirers of small minority shareholdings in companies which may be subject to the FDI notification obligation should therefore consider whether the implementation of a shareholder’s agreement or other forms of contracts could give rise to an FDI notification obligation.

Acquisitions of assets will continue to be exempt from the scope of the FDI notification obligation under the revised rules.

New stand-still obligation

Under the provisions of the current National Security Act, transactions subject to an FDI notification obligation may close the transaction and send the notification no later than 60 days after closing. That the notification obligation was of a post-closing nature was particularly useful, as only the acquirer is subject to the notification obligation, while only the target and potentially also the seller, is aware that the target has been subjected to the FDI notification obligation under the act.

The proposal seeks to significantly alter the notification process. Firstly, the Government has proposed the implementation of a stand-still obligation, modelled largely on Norwegian (and EU) merger control legislation, which prevents closing of the transaction until the authority has approved its completion. As under the current National Security Act, the authority has 60 working days to approve the transaction or alternatively refer the matter to the Norwegian Government for further review. There is no automatic clearance if the authority exceeds it’s 60 working day review period in “Phase I”, and no deadline for any further review performed by the Norwegian Government in “Phase II”.

Secondly, the Government has proposed the implementation of a ban on exchange of all information which may be used to perform activities which may threaten Norwegian national security until the authority has approved the implementation of the transaction. Parties to the transaction may apply for an exemption to the authority, which may provide the exemption either unconditionally or subject to conditions. The proposal envisages that such conditions may, inter alia, take the form of mandated agreements to be implemented to safeguard the exchanged information or that the information is only exchanged through “clean teams” of external advisors which may themselves need to obtain security clearance under the provisions of the Act in order to gain access to the relevant information.

Thirdly, the Government has proposed to expand the scope of the FDI notification obligation to also rest with the target and the seller. The scope of the FDI notification obligation imposed on the target and the seller will be limited to instances where the acquirer exceeds any of the thresholds directly (i.e. without regard to shareholdings held by related companies). Under the current act, the duty to notify rests solely with the acquirer.

Failures to notify may soon lead to fines

The Government has proposed that negligent or intentional failures to notify a transaction subject to an FDI notification obligation may be penalized by the National Security Authority with fines imposed on the corporate entities involved in the transaction, including the acquirer, target entity and the seller. Under the current National Security Act, fines may only be imposed for negligent or intentional breaches of certain other provisions of the Act, such as failures to adequately protect sensitive security-related information.

The size of the fines has not been determined or clarified. As the wording of the provision bears similarities to the provisions regulating fines under the Norwegian Competition Act and includes references to the turnover of the entity subject to the fine, the fines may prove to become significant.

The contents of the new proposal may still change as the proposal undergoes review by Parliament. Some aspects of the new proposal, such to the application of the threshold for an FDI notification in certain circumstances, are furthermore expected to be further detailed by regulations enacted by the Government at a later time. Nevertheless, businesses which are involved in M&A dealings concerning Norwegian companies should be prepared that the revised Norwegian National Security act will significantly widen the scope of the Norwegian FDI regime, and should plan transactions accordingly.

BAHR will continue to provide updates on the proposal for a revised Norwegian National Security Act, and will provide a summary of the final and enacted legislative proposal.