In short: almost every cross-border defence deal now needs at least one government's approval on national security grounds, and many need three or four. The approvals decide the timetable, the conditions to closing and, often, what the buyer must promise about the business after closing. For acquisition lenders they decide how long commitments must stay open. Screening is now a deal workstream from day one, not a filing at signing.
The regimes that matter most
| Regime | Trigger | Timing | If ignored |
|---|---|---|---|
| UK National Security and Investment Act | Mandatory notice for acquisitions of more than 25%, 50% or 75%, or of blocking votes, in 17 sensitive sectors including defence; voluntary notice for others | 30 working days to decide whether to call in; then 30 working days, extendable by 45 and more by agreement | Transaction void; fines up to 5% of worldwide turnover or £10m; call-in for up to five years |
| US CFIUS | Foreign investment in US businesses; mandatory for some critical technology deals and some foreign government investments | 30-day declaration, or 45-day review plus 45-day investigation | Penalties and possible forced divestment |
| ITAR registration | Sale or transfer of ownership or control of a registrant to a foreign person | 60 days' advance notice to the State Department | Civil and criminal penalties |
| US security clearances (FOCI) | Foreign ownership, control or influence over a cleared contractor | Mitigation agreed with the Defense Counterintelligence and Security Agency before or at closing | Loss of facility clearance and contracts |
| EU member state screening | National regimes, coordinated under EU Regulation 2019/452 | Varies by country | Varies; often void or suspended |
The rest of this guide covers how screening feeds into conditions, long-stop dates and break fees, the mitigation packages buyers are asked to accept, and what acquisition lenders need to see. It is free with a work email, along with the register downloads and the in-house counsel tools.
Read the full guide
Free. Work emails only. Unsubscribe at any time.
Questions
Does every UK defence acquisition need NSIA approval?
Acquisitions of control in the defence sector, and in the other 16 sensitive sectors, must be notified and approved before completion when the buyer crosses 25%, 50% or 75% of shares or votes, or gains votes to pass or block resolutions. A deal completed without approval is void.
How long does CFIUS take?
A short-form declaration is assessed in 30 days. A full notice has a 45-day review, which can be followed by a 45-day investigation, so a contested filing can take four to six months including pre-filing.
What is the ITAR 60-day notice?
A company registered with the US State Department under ITAR must notify it at least 60 days before a sale or transfer of ownership or control to a foreign person.
Sources
- GOV.UK: National Security and Investment Act collection
- US Treasury: Committee on Foreign Investment in the United States (CFIUS)
- eCFR: 22 CFR 122.4, notification of changes in registration information (ITAR)
- eCFR: 32 CFR Part 117, National Industrial Security Program Operating Manual
- European Commission: investment screening
General information on public law and market practice as at 28 Oct 2026, not legal advice on any transaction.