Significant amendments to the investment control regime rules in the Norwegian Security Act

The Bergen Engines AS case in 2021 illustrated how demanding it can be to get a picture of the risks in a complex value chain with businesses across sectors and national borders. The case concerned the sale of an engine manufacturing company (manufacturing engines to inter alia Norwegian and US marine vessels), to a Swiss company partly owned by a company with ties to the Russian Government. Bergen Engines also owned a large property strategically located at the entrance to Bergen. The Norwegian Government decided to block the transaction stating inter alia that the sale could lead to transfer of important technology to Russia. Together with the increasing geopolitical tension and the war in Ukraine the case triggered the need for an upgrade of the Security Act.      

The amendments will increase the government’s ability to reveal security threatening transactions and economic activity and thus strengthen the ability to protect Norwegian and allied security interests.  

Some of the amendments entered into force 1 July 2023, inter alia:

• Expanded competence for the authorities to decide that the Security Act shall apply to more businesses than previously comprised. This implies that businesses that control information, information systems, objects, or infrastructure, or conducts other activities which are of decisive importance for national security interests without being directly linked to basic national functions, may be subject to the act.
• The threshold for subjecting businesses to the provisions on ownership control in chapter 10 is lowered so that more businesses in the future will be subject to chapter 10 even if they are not subject to other parts of the act.
• Businesses are required to identify properties which, due to their location, may facilitate safety-threatening activities against object and infrastructure that need protection. If it is not possible to maintain a sufficient level of security for such properties, the security authorities shall be notified and the authorities shall keep track of the properties.
• Certain definitions are expanded, such as the definition of information systems, objects, and infrastructure worthy of protection. This will have consequences for how such values worth protection are classified and for the businesses assessment and the implementation of security measures to maintain a proper security level.

The main amendments to the investment control regime that will enter into force in 2024 are:

• Threshold for notification based on ownership interest: The threshold for notification to the authorities of an acquisition of a direct or indirect ownership interest in a business, company, or property subject to the act, will be lowered from 1/3 to 10 %. The authorities’ period of 60 working days from receiving the notification to inform whether the transaction has been approved or referred to the Government for further consideration was not changed.    
• Notification based on other than ownership interest: The obligation to notify the authorities will also apply if the acquirer achieves significant influence over the management of a business, company, or property subject to the act other than through ownership. This alternative will likely be clarified in more detail in regulations issued pursuant to the act.     
•  Repeated notification: The act clarifies a repeated obligation to notify acquisitions of at least 20%, 1/3, 50%, 2/3 and 90%.      
• Close associates to the acquirer: Ownership interest or other influence instruments belonging to close associates, as defined in the Securities Trading Act section 2-5, of the acquirer will be counted together with the acquirer’s.
• Standstill obligation: There will be an automatic implementation ban on the transaction during the period in which the authorities consider the case.
• Subjects to the rules: The obligation to notify the authorities will no longer only apply on the acquirer, but also on the seller and the business or property subject to the acquisition. For the seller and the business, the duty to notify applies only in relation to a direct acquisition, i.e. where they will be able to identify a notification obligation.
• Restriction on information sharing: For acquisitions subject to notification, information that may be used for security threatening activities cannot be shared without consent from the authorities until the transaction is cleared.
• Businesses with supplier clearance according to section 9-3: Such businesses will be subject to the notification obligation and the standstill obligation, implying that the transaction can be stopped and not only result in a withdrawal of the supplier clearance.
• Fines and penalty: The authorities may impose fines for violation of the notification obligation and the implementation ban. Violation of decisions according to section 2-5 (decisions by the Government) and section 10-3 (decision to stop an acquisition) may be sanctioned with imprisonment or fines as a criminal offence.

The amendments above are said to enter into force when the ministry has updated the regulations pursuant to the act, which is likely to happen in the first half of 2024. Against the backdrop of the geopolitical situation, it is assumed that the authorities will have substantial attention on the investment control regime.