The Norwegian Government recently announced[1] that it will stop the sale of Bergen Engines from Rolls-Royce to TMH International AG based on the Norwegian Security Act.[2]

The Norwegian Security Act’s scope is dynamic and relevant for several sectors such as infrastructure, electronic communication, power supply, water supply, banking, finance, police, defence and public procurement. In this newsletter, we share our perspective on how to deal with the risk of ownership restrictions in an M&A process.

Key takeaways – what should you take into consideration?

Even if a business is not made subject to the Norwegian Security Act, a contemplated transaction can be stopped, or ownership restrictions can be applied in other ways, pursuant to the Norwegian Security Act. Based on the dynamic scope of the Act, it is in the interests of both the buyer and the seller to clarify and adequately reduce the risk. Our high-level recommendations are:

to ensure that sufficient information is gathered throughout the due diligence process;
based on the information, to perform an initial risk assessment, including whether the target is made subject to the Act or depends on a security clearance and thus whether a notification must be submitted or other clarifications are needed; and
when the regulatory risk has been identified and mitigated, to adequately address the potential remaining risk in the SPA.

When does the Norwegian Security Act come into play, and how can ownership restrictions apply?

The Norwegian Security Act’s purpose is to protect Norway’s sovereignty, including its territorial integrity and democratic system, prevent, detect and counter activities that present a threat to security and ensure that security measures are adequately implemented.[3]

The Norwegian Security Act applies to governmental, county and municipal bodies.[4]

Furthermore, the Act applies to undertakings made subject to the Act by a ministry, within its area of responsibility, or alternatively the Norwegian Security Authority (NSA). The respective ministry or the NSA decides whether the Act applies, wholly or partly, to undertakings which (i) handle classified information, (ii) control information, information systems, objects or infrastructure which are of vital importance to fundamental national functions or (iii) engage in activities which are of vital importance to fundamental national functions.

In addition, the Act applies to suppliers of goods or services in connection with classified procurements.[5] These suppliers are suppliers that have or may gain access to or influences classified information or may gain access to critical national objects or infrastructure. These suppliers will enter into a security agreement, from which certain obligations and rights ensue.

Alternative ways in which ownership restrictions can be applied:

To undertakings made subject to the Act[6]: The King-in-Council may decide, pursuant to section 10-3, that an acquisition of a qualified ownership interest in an undertaking cannot be implemented, or that the implementation shall be subject to conditions, if it may present a not insignificant risk of a threat to national security interests.
To undertakings that supply goods or services in connection with classified procurements: the security agreement can contain change of control clauses and if the undertaking has a security clearance, the supplier, pursuant to section 9-3, shall as soon as possible notify the NSA concerning changes in the ownership structure. If a potential security risk within the ownership structure cannot be mitigated, the security clearance may be withdrawn.
To any undertaking regardless of whether it is made subject to the Act: The King-in-Council may use the additional statutory powers, pursuant to section 2-5[7], to make necessary decisions, including but not limited to stop the acquisition, or that it only may be carried out on certain conditions (or other necessary decisions), if the ongoing activity may present a not insignificant risk of a threat to national security interests.

How to know to what extent the Norwegian Security Act is relevant?

Firstly, it will be crucial to establish whether the target business is made subject to the Norwegian Security Act. The ministries are responsible within their respective areas and can on certain conditions decide whether the Act, wholly or partly, shall apply to an undertaking.[8] Alternatively, if the undertaking falls outside the scope of the ministries’ areas of responsibility, the NSA shall decide whether the Act applies.[9] The undertaking shall be notified prior to such a decision and be given the opportunity to comment on the proposed decision.[10] When the decision is made, the ministry shall report this to the NSA.[11] As of today, there is no published list of undertakings made subject to the Act. The ministries are mapping which undertakings should be subject to the Act and the list will be continuously updated.

Secondly, it will be important to gather information on whether the business is a supplier in connection with classified procurements and thereby a party to a security agreement pursuant to chapter 9 of the Act.

Thirdly, it will be important to understand whether the target business and the potential new ownership structure could be limited by the Act in other ways.

The NSA refers to the fact that the scope of the Act is dynamic.[12] There are several circumstances that make the Act more relevant than before, e.g. the fact that privately owned companies play a more important role in supporting fundamental national functions than before[13], that the technology development leads to new dependencies and vulnerabilities for national security interests[14] and that the complexity of potential threats are changing.[15]

In the context of an acquisition, the buyer needs to rely on information provided by the seller and the target undertaking as to whether it is made subject to the Act or a party to any security agreements. However, during an ongoing M&A process, the business may be made subject to the Act. Furthermore, if the acquisition entails a not insignificant risk of a threat to national security interests, the acquisition may be suspended, blocked or unwound. Thus, the buyer should always assess whether the Act may apply.

Dealing with a business made subject to the Norwegian Security Act

Although it is the Seller who knows whether the undertaking is made subject to the Norwegian Security Act, the obligation to notify the ministry, alternatively the NSA, rests with the buyer.[16]

The obligation to notify applies to the acquisition of any undertaking made subject to the Act provided the ownership share is qualified.[17] The buyer’s own shares in the target or any shares in the target owned by an affiliate of the buyer are relevant to the assessment of whether the ownership share is qualified.[18]

The time used to process the notification can vary. The relevant authority which receives the notification shall process the notification as quickly as possible and shall notify the buyer of the outcome within 60 working days, i.e. whether the acquisition is accepted or whether the case needs to be processed by the King-in-Council.[19] The process may take longer if the authority requests more information within the 50 first days of the review, suspending the 60 working day time limit until the request for more information has been met.

An acquisition can only be blocked, or made subject to specific conditions, if the acquisition may present a not insignificant risk for a threat against national security interests.[20] The wording implies that there is no need for the threat to be likely to occur.[21] However, the preparatory works set out that the access to stop acquisitions shall be narrow and should only be applied on an exceptional basis.

A risk-based assessment of the particular acquisition must be carried out. This risk assessment should include the potential likelihood of the threat materializing, balanced with the potential consequences if the threat materializes. The more significant the potential consequences for the national security interests are, the more the likelihood of intervention increases, and vice versa. The content of the decision must also be proportionate, i.e. balanced between the economic disadvantage and the protection of national security interests.

If the target business is made subject to the Norwegian Security Act, or there is a high risk that it will be prior to completion of the acquisition, the SPA should take into account the possible processing time of the notification, the possible processing time in the King-in-Council, and the outcome of such processing. The Act does not explicitly prohibit the completion of an acquisition before the notification has been processed[22], but both the buyer and the seller can be exposed to unnecessary risk if the risk is not managed correctly.

Dealing with a business that is a supplier in connection with classified procurements

If the target business is a supplier in connection with classified procurements, a security agreement relating to the supply must be entered into.[23] In addition, if the business has access to a certain level of classified information it might also need a security clearance.[24] Thus, during the due diligence process it will be necessary to establish whether the security agreement contains any change of control regulations and whether clearance have been issued, and, if so, the target business must notify the NSA[25] as soon as possible pursuant to section 9-3 of the Act. If a security risk arises with regard to the ownership change and the risk cannot be mitigated, the NSA may withdraw the clearance, which again could impact ongoing business.

Dealing with a business not made subject to the Norwegian Security Act

The Norwegian authorities have the possibility, in section 2-5, to make necessary decisions relating to any transaction in which the transaction carried out may represent a not insignificant risk of a threat to national security interests.

There is no absolute requirement that the target company been made subject to the Act. In that regard, circumstances on the buyer side in combination with other elements may be argued to be sufficient to fulfil the condition, e.g. if the buyer owns other businesses that in combination with the target business may present a threat to national security or if the buyer, or stakeholders within the buyer, own certain businesses in Norway that are deemed a threat. However, the additional statutory powers are meant for exceptional use only and cannot be exercised without a proper assessment of national security interests. As the decision must be necessary, the decision cannot be more burdensome than required and must be reasonable in the specific case.[26]

The parties to acquisitions should strive to obtain a sufficient basis for performing necessary risk assessments throughout the due diligence process, thereby reducing the risk for both the buyer and the seller side. If necessary, the parties should address the risk in the SPA. A risk mitigating measure can in certain cases be to notify the relevant authority of an ongoing activity although the business has not been made subject to the Norwegian Security Act.

[1] See press release: Regjeringen stanser salget av Bergen Engines til TMH – regjeringen.no in which it is stated that a proposal for a decision in the King-In-Council will be submitted on 26 March 2021

[2] The Act relating to national security (the Security Act) of 1 June 2018 no. 24, which entered into force on 1 January 2019

[3] Cf. the Norwegian Security Act section 1-1

[4] Cf. Section 1-2 first subsection

[5] Cf. Section 1-2 second subsection cf. chapter 9

[6] See section 10-3 cf. section 10-1 cf. section 1-3

[7] Please note that the “safety valve” in section 2-5 may also be used for undertakings classified as subject to the Norwegian Security Act if the decision cannot be based on section 10-3

[8] See this article section 2.1. with reference to the conditions in section 1-3 first subsection letters a to c

[9] Cf. Section 1-3 fourth subsection

[10] Cf. Section 1-3 second subsection

[11] Cf. section 2-1 first subsection letter d with reference to letter c

[12] See: Sikkerhetsloven og forskrifter – Nasjonal sikkerhetsmyndighet (nsm.no)

[13] See NOU 2016:19 Samhandling for sikkerhet, Beskyttelse av grunnleggende samfunnsfunksjoner i en omskiftelig tid, page 226

[14] See Prop.153 L (2016-2017) page 10 with further reference to inter alia NOU 2015:13 Digital sårbarhet – sikkert samfunn.

[15] See Prop.153 (2016-2017) page 32

[16] Cf. Section 10-1

[17] Cf. Section 10-1 second subsection, in which qualified means that the ownership share, directly or indirectly, will give the buyer (i) at least one-third of the share capital, participating interests or votes in the undertaking, (ii) the right to own at least one-third of the share capital or participating interests or (iii) significant influence over the management of the company

[18] Cf. Section 10-1 third subsection

[19] Cf. Section 10-2 first and third subsections

[20] There is no formal requirement for stopping an acquisition pursuant to section 10-3 that a prior notification has been made, cf. Prop. 153 L (2016-2017) page 192

[21] This is also supported by the preparatory works, cf. section 10-3 page 192

[22] See Prop.153 L (2016-2017) page 151

[23] Cf. section 9-2

[24] Cf. section 9-3

[25] The King-in-Counsel has appoved the NSA as clearance authority, cf. regulations, FOR-2018-12-20-2054 Klareringsforskriften, section 32

[26] See Prop. 153 L (2016-2017) page 169

Newsletters and invitations