When Energy Becomes Strategic: Foreign-Ownership Review in M&A

1 Start with the investment decision, not a filing checklist

A buyer may describe an electricity network, water concession, port, data centre or critical-minerals processor as an infrastructure asset. A screening authority may see a different perimeter: control of a service needed during an emergency, access to network information, influence over maintenance, or a dependency that connects several essential systems. The deal team's first question is therefore commercial and operational. What capabilities and rights will the buyer actually acquire, and can the investment still meet its return and service objectives if some of those rights must be restricted?

Foreign-ownership review is not synonymous with a prohibition on foreign capital. It is a process in which national authorities apply their own jurisdictional and substantive tests. Under the UK's National Security and Investment Act, specified entity acquisitions in sensitive sectors can require mandatory notification, while other qualifying acquisitions can be subject to call-in or voluntary notification [1,2]. The US Committee on Foreign Investment in the United States, or CFIUS, reviews covered transactions and certain real-estate transactions; only defined categories carry mandatory declaration requirements [3,4]. The EU's new screening regulation sets a future common minimum for Member State systems, while individual Member States remain the screening decision-makers [5,6]. These differences demand a jurisdiction-by-jurisdiction analysis by qualified counsel.

The commercial point is broader than identifying the correct form. A condition that requires a ring-fenced operator, limited data access or a change to board rights can alter the buyer's operating model. It may change the bankability of cash flow, the cost of compliance, the timing of completion and the attractiveness of a future exit. A proposed remedy that leaves the buyer unable to deliver the value-creation plan should be treated as a redesigned investment, not as a modest legal footnote.

This paper provides an analytical transaction framework. It is not legal, regulatory, national-security, tax, accounting or investment advice. It does not determine whether any actual acquisition is notifiable, whether a government will approve it or which remedy a government would accept. Every transaction requires current local advice, verified ownership information and target-specific technical evidence.

2 Map the five rights that an acquisition can transfer

The share percentage is a poor substitute for a rights map. Economic rights determine distributions and residual value. Governance rights determine appointments, vetoes, budgets and strategic direction. Operational rights determine dispatch, maintenance, cybersecurity, procurement and incident response. Information rights determine access to customer, network and government data. Physical rights determine entry to substations, control rooms, cable landings, reservoirs and other sensitive facilities. A minority holder can have limited economics and still possess a decisive right in one of the other four domains.

The rights map should be built from the actual share purchase agreement, constitutional documents, shareholder agreement, licence, concession, operating agreement, financing documents and information architecture. It should identify who exercises each right before and after closing, what consent is required to change it, and whether the right can be separated from the investment without destroying the thesis. Side letters and informal operating practices deserve inspection. A contractual limitation on access may be ineffective if the investor's nominee can still instruct the administrator who grants access.

Investor identity must be traced through the full chain of ownership and influence. Direct equity, limited-partner rights, debt covenants, management contracts, voting arrangements and government-linked investors can each be relevant to a particular regime. Canada's published national-security guidelines identify the ultimate controller and potential third-party influence among the factors considered [7]. The UK's notification guidance asks for structure charts and ultimate beneficial ownership information [2]. A fund's marketing description is not a substitute for verified governance documents.

The result should be a controlled rights register, not a slide with a red flag. Each row should include the asset or information, current owner, proposed recipient, legal source, operational method, regulatory question, proposed safeguard, evidence owner and decision date. Legal counsel can then distinguish rights that create a notification question from rights that create a substantive security concern. The finance team can identify which safeguards would carry recurring costs or remove expected synergies.

Author-developed rights map. It does not state the legal test of any jurisdiction.

3 Define the asset as a system of dependencies

An acquisition target rarely consists of one isolated site. An electricity network may depend on telecommunications, fuel, water and digital control systems. A data centre may depend on a grid connection, cooling water, fibre routes, cloud customers and security-cleared operations. A port may host power, fuel and communications infrastructure. A mineral processor may sit between a domestic resource and a defence or energy technology supply chain. The target perimeter should therefore include the systems it can influence, even when the purchase agreement transfers only one company.

The first diligence map is physical: facilities, licences, connections, critical equipment, contractors and geographic concentration. The second is digital: operational technology, privileged accounts, remote access, cloud hosting, telemetry, encryption keys and data flows. The third is contractual: emergency-service obligations, government customers, supply agreements, financing covenants and cross-defaults. The fourth is organisational: named decision-makers, operating contractors, incident authority, board committees and parent support. These maps should be reconciled to actual evidence, not assumed from sector labels.

Criticality has to be established under the applicable regime. The UK's mandatory sectors include Energy and Data Infrastructure, but the detailed activity descriptions and thresholds control whether a particular entity acquisition is notifiable [1]. The EU's 2026 regulation refers to energy, transport and digital-infrastructure entities considered critical through a Member State's targeted assessment; its common minimum applies from 17 January 2028, according to the European Commission [5,6]. A data centre is therefore not automatically within every screening category simply because it houses servers.

An asset can be commercially important without being legally within a specific mandatory filing rule. The reverse also matters: a qualifying acquisition can require a filing even if the deal team considers the operational risk low. The board should receive two separate conclusions: a local-counsel jurisdiction assessment and an operational risk assessment grounded in the target's dependency map. Conflating those conclusions can create both filing errors and mispriced remedies.

4 Separate investor risk, asset risk and transaction risk

The same physical asset can present different questions under different investors and rights packages. Investor risk concerns ultimate control, beneficial ownership, state influence, compliance history, funding and the ability to honour mitigation obligations. Asset risk concerns continuity of essential service, sensitive data, proximity, technology and the consequences of disruption. Transaction risk concerns the new rights, access and dependencies created by the deal. Each should be described separately so the investment committee can see which dimension can actually be changed.

The team should avoid using nationality as a proxy for an authority's decision. Published guidance may identify ownership or state influence as relevant, but the assessment remains jurisdiction- and fact-specific. Canada's guidelines expressly refer to ultimate controller, third-party influence, critical infrastructure, critical minerals and sensitive technology [7]. CFIUS regulations distinguish covered control transactions, certain non-controlling investments, and covered real-estate transactions [3,4]. Those categories are legal tests, not a general risk score invented by an adviser.

Transaction design can change exposure. An investor might purchase passive economics while leaving day-to-day operating authority with a licensed domestic operator. It might acquire an asset company while sensitive government contracts remain outside the perimeter. It might defer access to information until clearance. Each option can affect price and execution. Counsel must test whether the design genuinely changes control or merely relocates it on paper. A proposed structure built solely to disguise effective control can create greater risk than an honest filing and a workable mitigation proposal.

The team should document the counterfactual. What happens if the seller retains the asset, sells to another buyer, separates a sensitive business, or raises debt instead? The counterfactual gives the board a reference for price, service continuity and opportunity cost. It does not predict an authority's view. It helps determine how much of the intended value comes from rights that may be constrained.

Table 1. Ownership-review evidence by risk channel

Author-developed diligence template. Legal applicability depends on the actual jurisdiction and deal.

5 Build a regime map with current legal status

A cross-border transaction can engage foreign-investment screening, sector-ownership rules, licence transfer, merger control, data protection, export controls and land approvals. These are distinct processes. A clearance in one does not substitute for another. The regime map should state the law, authority, triggering event, target activity, investor threshold, mandatory or voluntary route, filing timing, standstill obligation, review stages, possible outcome and appeal or reconsideration route. Counsel should update it at signing and again before completion.

In the UK, the National Security and Investment Act permits review of qualifying acquisitions and requires advance notification for certain acquisitions of entities active in defined sensitive areas [1,2]. Asset acquisitions can raise call-in questions even where they are not in the mandatory entity-notification category. Government guidance for new-build gas and electricity assets illustrates why the rights and development stage matter [11]. The transaction documents should therefore define exactly which entities and assets are transferred at each closing step.

In the US, CFIUS jurisdiction includes covered transactions and certain real-estate transactions, with mandatory declarations limited to specified categories [3,4]. The Treasury states that transactions described in its real-estate regulations do not have a mandatory declaration requirement, though parties may choose to notify [4]. A data-centre site near a listed installation and an acquisition of a covered operating business require different analyses. The Committee's 2025 annual report confirms an active caseload and continued focus on mandatory-filing compliance [9]; those aggregate figures do not predict the outcome of any single bid.

The EU's Regulation 2026/1386 entered into force in July 2026 and is scheduled to apply from January 2028 [5,6]. At the date of this paper, deal teams must still analyse the applicable Member State's current law. In Canada, the Investment Canada Act allows national-security review of foreign investments irrespective of value, within its statutory scope, alongside separate net-benefit rules [7,8]. Australia's published national-security guidance describes foreign-investment approval obligations for specified national-security businesses and land, including critical infrastructure [10]. These examples establish variety, not an exhaustive global survey.

6 Draw the approval-critical path before setting a closing date

The deal timetable should begin with factual readiness: verified ownership chart, target activity, relevant assets, licences, customer and data dependencies, financing sources and proposed governance rights. A filing prepared from an incomplete ownership chain or an obsolete operating diagram can be rejected, delayed or rendered unreliable. The approval-critical path must therefore include time to build evidence, not just statutory review days after a filing is accepted.

The team should place each authority and consent on one schedule. Foreign-investment review can run alongside merger control, sector licence transfer, land consent, lender approval, public procurement change-of-control and export-control analysis. Some processes allow parallel submissions; others depend on a prior approval or settled transaction perimeter. Counsel should mark the legal standstill point and any restriction on pre-close information sharing. The model should separately show the anticipated operating date, financing draw date and contractual long-stop date.

Recent UK figures illustrate why an average does not replace a transaction schedule. The 2025-26 official annual report states that most reviewed notifications proceeded without further action, while a smaller group proceeded to further assessment or final orders [12]. That is population-level history, not a clearance probability for a particular energy asset. The committee should test dated scenarios: clearance on the initial review path, extended assessment with information requests, clearance subject to a defined remedy, and no acceptable approval by the long-stop date.

Each scenario needs a cash consequence. A six-month delay may require bridge-finance carry, extension of a hedge, retention of key people, continued seller operation and delayed synergies. A remedy may require new staff and systems. A prohibition can trigger break costs and lost opportunity. These amounts should be sourced from actual financing terms or clearly identified as assumptions. The contract should specify who controls the filing, who answers questions, who can offer a remedy and who bears the cost if a deadline moves.

7 Make the data-centre question operational

Data centres are often described as passive real estate. Some are; others provide computing, storage, network interconnection or public-sector services, and can hold privileged operational information. Ownership review depends on the precise activity and rights, not the marketing label. The UK's published Data Infrastructure guidance distinguishes relevant infrastructure and qualifying activity, including specified public-sector and interconnection contexts [1]. Counsel must apply the current definition to the actual target.

The diligence team should identify customers by category, not expose unnecessary personal or classified information. It should map where data is stored and administered, which entity holds encryption keys, where remote support is located, who may enter sensitive areas, and whether new investor rights change any of these arrangements. Network and power dependencies matter: a facility with a large reserved grid capacity may have strategic importance for local electricity planning even if the servers themselves are contractually separated from the landlord.

Operational technology and customer data should be kept conceptually distinct. A utility's grid-control system presents different risks from the personal data held by a cloud tenant. A remedy directed at one may not solve the other. The target should provide a privilege matrix, subcontractor list, incident escalation diagram and audited access logs. The buyer should test whether the proposed architecture can function during outages, cyber incidents and owner disputes.

The value case needs the same precision. If the buyer's thesis depends on integrating customer data across countries, a localisation or access restriction can remove that thesis. If the thesis is simply to fund expansion of powered shell capacity, a ring-fenced operator may be acceptable. A purchase-price model that assumes unrestricted control while the regulatory plan assumes permanent separation is internally inconsistent.

8 Examine power, water, ports and minerals through different failure modes

An electricity network can fail through command, maintenance, procurement or cyber access. A generation plant can affect dispatch and fuel arrangements. A water utility can affect public health and industrial continuity. A port can concentrate logistics, fuel, customs and telecommunications. A critical-minerals processor can affect upstream supply and downstream technology. The deal team should identify the credible harm mechanism for each target rather than applying one generic national-security score.

Australia's Foreign Investment Review Board guidance identifies national-security issues across critical-infrastructure sectors, including energy and water [10]. Canada's guidelines identify critical infrastructure and critical-mineral supply chains as possible assessment factors [7]. The EU's new regulation lists energy, transport and digital infrastructure within a targeted common-minimum framework for future screening [5]. The UK specifies Energy and Data Infrastructure among its notifiable sectors, subject to the detailed activities [1]. These sources justify a disciplined screening inquiry; they do not prove that a specific target is critical or that a particular investor will be blocked.

The practical diligence test is to ask what a newly empowered party could cause or observe. Can it change maintenance priority? Redirect a scarce connection? Stop water treatment? Access a control room? See government demand data? Influence procurement of security-sensitive equipment? Control a mineral offtake? Each answer should be supported by a contract, system architecture, licence or operating procedure. If the supposed right cannot be evidenced, it should not be priced as a synergy or presented as a mitigation risk.

A target can also contain separable business lines. A port operator may have a conventional logistics business and a sensitive cable landing. A minerals group may own mining, processing and IP. A data-centre business may provide powered space and manage government workloads through different entities. A carve-out could be valuable, but it may require consent, new personnel and transitional services. The cost and operating resilience of separation should be tested before it is offered to an authority or used to set a bid.

9 Design a remedy that can actually operate

Publicly described mitigation tools include restrictions on information access, changes to governance, structural separation, monitoring and, in some cases, divestment or prohibition [3,13]. An investment committee should not assume that offering a remedy secures clearance. Its task is to determine whether a proposed arrangement can be implemented, independently verified and financed if a competent authority requires it. Counsel leads engagement with the authority; the commercial team tests operability and value.

A data-access remedy needs an identity system, segregation of environments, logging, independent audit rights, breach escalation and named accountable officers. A board-rights remedy needs enforceable voting and appointment documents. An operating-control remedy needs a qualified operator, a clear incident command chain and a budget. A local-resilience remedy may need domestic spares, supplier qualifications and step-in rights. Each proposed measure should have an implementation date and an annual cost, plus a credible replacement mechanism if a contractor fails.

The governance trap is a remedy that leaves responsibility without authority. A buyer may remain liable to lenders and customers for service continuity while being unable to direct maintenance. The mirror trap is a contractual promise of separation while the buyer retains practical control through shared IT or employment decisions. The technical and legal designs should be reviewed together. An auditor must be able to identify exactly which accounts, data and decisions are restricted.

The UK publishes notices of final orders that can show categories of conditions without disclosing every detail [13]. Those notices are useful examples, not model terms for a different asset. The board should ask three questions before approving a remedy envelope: which risk does the measure address, can it be operated safely through stress, and what value remains if it lasts for the full holding period? A remedy outside the authorised envelope should return to the committee rather than be negotiated into the deal by default.

Table 2. Remedy design and financing questions

Author-developed transaction template. No row predicts an authority's required or accepted remedy.

10 Translate review uncertainty into bid architecture

The buyer should set an offer price for a defined rights package, operating perimeter and approval outcome. If a required remedy removes part of the planned business, the model must be revised. A single headline price cannot safely absorb every possible national-security outcome. The bid can instead specify conditions and a remedy envelope: measures the buyer is prepared to implement, a maximum cost, an excluded structural change and a decision point for returning to the board.

The purchase agreement should align its conditions precedent, efforts standard, long-stop date, information covenants, remedy authority, termination rights and any reverse fee with that envelope. Seller and buyer can have different incentives. The seller may seek maximum certainty of close; the buyer may need a walk-away if it loses operating control. A vague obligation to use best efforts can leave a material economic dispute until an authority asks for conditions. Counsel should draft the negotiated allocation precisely under the governing law.

Before signing, the buyer should model a base transaction, a delay, a bounded operational remedy and a structural remedy. The structural case may have no financeable route at the offered price. That result is useful. It tells the negotiators to exclude the remedy, reduce the price, alter the perimeter or decline the transaction. It should not be smoothed into an average probability that lacks evidence.

An auction creates a temptation to leave review until exclusivity. A screening question can affect bidder eligibility and comparative certainty even before a formal filing. A seller can increase credible competition by preparing accurate asset, contract and security information for qualified bidders through controlled diligence. The buyer can improve its offer by demonstrating a realistic route to approval, not by making an unsupported promise of a rapid clearance.

11 Value a remedy as an operating design

Consider an invented acquisition of an electricity-services and data-infrastructure platform at a proposed enterprise price of USD 1.2 billion. Assume, solely for illustration, that the proposed price is supported by an operating forecast that excludes any foreign-investment remedy and any delay in completion. Assume the buyer funds USD 400 million of the purchase through a bridge facility at 8% annual cash interest and that closing is delayed six months. The incremental bridge carry is USD 400 million multiplied by 8% multiplied by one half, or USD 16 million. A real facility can include fees, ticking interest, hedging, commitment charges and refinancing effects; none is estimated here.

Assume further that a technically feasible segregation plan costs USD 18 million at completion and USD 4 million at each year end for seven years. At a hypothetical 10% discount rate, the seven-year annuity factor is approximately 4.86842. The recurring present cost is approximately USD 19.47 million and the total remedy cost is USD 37.47 million. The sum of remedy and incremental bridge carry is USD 53.47 million. Applied only to a bid that excludes both, the illustrative supported amount would fall from USD 1.2 billion to USD 1.14653 billion before tax, financing-structure, synergy and other deal effects. This is a conditional arithmetic bridge, not a market valuation or an estimate of regulatory demands.

The remedy can affect the forecast more than its explicit invoices. A data wall may remove cross-selling, delay customer migration or require separate systems. A domestic operator may be better at resilience yet reduce the buyer's direct control. A carve-out may leave stranded overhead in the retained business. The model should therefore separate implementation cash, recurring operating expense, foregone revenue, capital expenditure, financing constraints and exit-value impact. Each item must have a specific mechanism to avoid double counting.

The investment committee should request a threshold analysis. How much annual synergy can disappear before the acquisition fails its hurdle? How long can closing be delayed before the bridge or equity commitment expires? What minimum operating rights are required by lenders and insurers? A clear threshold is more decision-useful than a single estimate of “regulatory risk.” If a proposed safeguard exceeds a threshold, the committee can seek a price change, different financing or a smaller acquired perimeter.

Table 3. Entirely hypothetical bid adjustment

Author assumptions only; USD millions. No source represents these figures as observed data or an approved remedy.

12 Test the lender's security and control package

Lenders can finance an acquisition only against the cash flow, security and governance rights they actually receive. A security package may include shares, bank accounts, operating assets, receivables and step-in rights. Foreign-investment conditions or sector licences can limit enforcement, transfer or control of those interests. The finance team should check whether the lender's proposed security survives the remedy and whether enforcement would itself require approval. A loan that assumes free transfer of a sensitive operating licence can be less robust than its documentation suggests.

Debt covenants can interact with mitigation. A lender may demand access to detailed operating information that the buyer is prohibited from receiving. It may want to replace an operator after default, while the approved remedy requires a specified independent operator. A cash sweep may conflict with the funds needed for mandatory cybersecurity and continuity spending. The solution is deal-specific: tailored reporting, permitted recipients, pre-agreed replacement criteria, reserves and a workable step-in protocol. It must be negotiated with both lenders and relevant authorities where needed.

Financing commitments need timing tolerance. A statutory review period is only one part of a transaction calendar; additional information requests and conditions can extend the practical path. The buyer should identify commitment expiries, syndication deadlines, hedging windows, ticking fees and covenant measurements. If the debt package cannot survive a realistic extended-review case, the investment committee should not call the bid fully financed. A contingent refinancing assumption should be shown as such.

The remedy budget should be an operating covenant, not merely a signing model cell. Dedicated staff, independent audits, security technology, training and periodic reporting have annual cash needs. A maintenance or cyber cost cut during a downturn could breach the remedy and damage the business. The financing model should protect required spend in downside cases. Legal counsel must determine which obligations bind the target, investor, parent and lenders; the paper's analytical framework does not decide those allocations.

13 Separate minority capital from influence

A minority investment can look less intrusive than a control acquisition while conveying substantial governance or information rights. An investor might hold a veto over budgets, technology procurement, debt, customer contracts or a change of operator. It might nominate directors, receive sensitive management reports or have an option to increase its stake. These rights must be examined under the applicable screening and sector rules. A numerical ownership threshold alone does not tell the board whether the target's operating discretion has changed.

Conversely, a passive investor can provide capital with carefully delimited rights. A preference share may offer an economic return without routine operational information. A fund can delegate voting within a genuine independent governance arrangement. A strategic partnership can keep sensitive activities with a licensed domestic entity. Each design has economic consequences. The investor may demand a higher return if its protections are reduced, and the operator may need additional working capital or independent oversight. The value bridge must capture the cost of the approved design.

The seller should test cumulative influence across instruments. Equity rights, convertible debt, supply contracts, technology licences and management services may each be limited when read alone but collectively permit direction of a sensitive business. The target's board needs one consolidated rights schedule. The schedule should include future exercise conditions: an option, default step-in or lender enforcement may create a later change in control even if initial closing does not.

This section is a transaction-design method, not a universal rule that a minority stake does or does not require notification. Relevant tests differ among the UK, US, EU Member States, Canada, Australia and other jurisdictions [1-10]. Current legal advice is needed for the precise instruments and investor. The investment committee should approve the rights package it intends to acquire, rather than approve a percentage with crucial terms left to final documentation.

14 Use a clean information architecture before closing

Due diligence can expose security-sensitive information before any share transfers. The seller may need to show reliability, cyber maturity, customer concentration and technical capability to credible bidders. It also has obligations to protect confidential and potentially restricted data. A clean-team structure can let approved advisers assess the commercial and technical questions while limiting access by the bidder's operating staff. Counsel should determine the legal basis, permitted recipients and controls; a confidentiality agreement alone may not address every restriction.

The data-room plan should classify material by sensitivity and purpose. General financial statements, public regulatory decisions and non-sensitive contracts may be available broadly. Detailed grid diagrams, privileged cyber logs, public-sector service configurations, credentials and personal data may need narrower review or redaction. A bidder should receive enough reliable information to price the asset while avoiding unnecessary transfer of operational know-how. A third-party technical opinion can sometimes report a bounded conclusion without distributing the underlying sensitive files.

Access rules should also guard against premature integration. The buyer should not direct target operations before closing merely because diligence is advanced. Competition and sector rules can impose their own restrictions, separate from foreign-investment review. The team should set a pre-close conduct matrix for customer contact, system testing, staff planning and incident cooperation. Each proposed access should have a purpose, approval, duration and audit trail.

At signing, the diligence controls should be reconciled with the proposed permanent remedy. A buyer cannot credibly promise post-close segregation while designing integration around unrestricted access. If the authorities clear a different rights package, the architecture may need redesign. The purchase agreement should permit necessary technical consultation and preserve service continuity without allowing an informal transfer of control ahead of approval.

15 Distinguish review from parallel sector and competition controls

Foreign-investment screening is one layer in a deal. A utility may also need licence transfer or change-of-control consent. A port concession may require public-owner approval. A water facility may have operating or environmental permits. A data-centre customer contract may restrict assignment or location. A minerals business may have export-control or land-related requirements. Merger control tests market effects under a separate framework. None should be assumed to be satisfied by a national-security clearance.

The approval matrix should record each legal authority, contractual counterparty and lender. It should separate mandatory filings from prudent engagements, and public approvals from private consents. The team should identify which consent can be obtained before signing, which can be sought between signing and closing, and which requires a post-close compliance plan. If a licence is personal to the current operator, a share purchase may be simpler than an asset purchase or it may create a different change-of-control trigger. Counsel must test actual terms.

The complex case is where remedies interact. A competition authority may require divestment of an asset that a national-security authority expects the purchaser to operate. A foreign-ownership condition may prescribe a local operator that lacks an essential sector licence. A data-localisation design may create unanticipated customer consent requirements. The deal team should not negotiate each approval in a separate silo. A single technical architecture, rights map and dated transaction perimeter should be used across workstreams.

The investment committee should see unresolved conflicts early. A matrix cell marked “approval expected” is insufficient. The record should say what document or authority supports the view, what alternatives exist, who can negotiate a change, and how the decision affects price. If two conditions cannot be reconciled, the correct commercial action may be to change the deal perimeter or stop. That option belongs in the signed mandate.

16 Make technical resilience part of the remedy case

A national-security remedy that disables normal operations can create the very continuity risk it aims to address. A ring-fenced utility operator needs authority to act during emergencies, access to spare parts, qualified staff and a tested communications path. A data-access restriction must still allow timely fault diagnosis. A port restriction should preserve safe vessel and cargo operations. A water utility must maintain treatment and monitoring. The technical diligence team should stress-test the proposed safeguards before they become undertakings.

The stress test should cover an outage, cyber incident, key-person departure, supplier insolvency, financing default and ownership dispute. For each event, identify who can issue instructions, who has the required data, who funds immediate work, and whether any response requires prior approval. A tabletop exercise can expose a broken command chain. It should be documented, observed by independent specialists where appropriate and translated into revised contracts and cost estimates. An elegant governance chart is insufficient if the incident-response team cannot act.

Dependencies across assets deserve special attention. A data centre's backup generation may share fuel delivery with an adjacent facility. A water plant may be required to cool an industrial load. A grid operator may rely on telecommunications owned by another group company. If the remedy separates entities, the critical service agreements among them must survive bankruptcy, cyber disruption and a change in investor. The board should know whether separation creates duplicated capability or a new single point of failure.

This technical work can support a more credible proposal to an authority, but it cannot establish what the authority will require. The objective is a plan that a licensed operator, lender and board can execute without compromising essential service. An untested remedy should remain a scenario. It should not be priced as an accepted condition or described to investors as a committed route to clearance.

Author-developed decision sequence; authority engagement and legal tests remain jurisdiction-specific.

17 Allocate review and remedy risk in the contract

The seller and buyer should agree who prepares and controls notifications, which information each must supply, whether a filing can be withdrawn, when either party may communicate with an authority and who may offer commitments. The buyer usually bears the operational consequences of a post-close remedy, while the seller is concerned with certainty and timing. Those interests need explicit contract terms. The agreed remedy envelope should define permitted operational conditions, financial limits and excluded structural outcomes.

Conditions precedent should be drafted against the actual regime. A transaction might require clearance, expiry of a waiting period, sector consent and lender approval. The condition should state what happens if clearance includes an order or undertaking. An “approval” that makes the asset uneconomic is commercially different from unconditional clearance. A reverse fee, if negotiated, should be linked to a defined failure route rather than used as an unexplained substitute for a viable close. The enforceability and operation of these terms require transaction counsel.

The interim operating covenant should let the target maintain safety and service. It should also prevent value leakage, extraordinary rights grants and changes to sensitive systems that undermine the filing. A consent right for the buyer cannot become unlawful pre-close operational control. The agreement can provide objective permitted actions and a fast dispute mechanism for emergencies. If a planned cyber or grid upgrade is essential, the parties should agree who pays for it during review and how it affects price if closing fails.

Post-close obligations need durability. An independent monitor may require budget and access throughout ownership. An undertaking may survive a refinancing or change in operator. The buyer should know which group entities are bound, what happens on sale, and whether a future purchaser can assume the conditions. A remedy that materially limits the exit market can reduce terminal value. The model should include that constraint rather than treating it as a legal appendix.

18 Give the board an explicit decision record

The board should receive one integrated decision paper. It should identify the target entities and assets, ultimate investor chain, acquired rights, sensitive dependencies, counsel's filing analysis, sector and competition approvals, technical harm pathways, proposed remedy envelope, financing terms, bid adjustment and dated gates. Each conclusion should be tied to an evidence source and an owner. The record should separate verified transaction facts, professional opinions and hypothetical scenarios.

The committee should approve a bounded set of outcomes: bid at the stated price and rights package; bid subject to specified conditions and maximum remedy cost; redesign the perimeter or capital structure; or decline. It should set a maximum delay and an authority for extending the long-stop date. It should specify which changes require a return to the board, including transfer of operational control, loss of a critical customer, an unfinanceable lender condition or a remedy outside the approved cash envelope.

The record must survive staff turnover and negotiation pressure. A written decision log should show what was known when the bid was made, why the screening route was chosen and how later information changed the case. It should capture commitments made to regulators, customers, lenders and the seller. Management should not present a scenario as a regulatory position until the authority has actually stated it. An early engagement may be useful, but it is not a binding clearance unless the relevant law and process say so.

The table below is a generic template. It should be populated with actual dates, evidence and accountable people in a live transaction. Its purpose is to connect a right, potential restriction and economic consequence to a decision. A risk register with colour ratings alone does not show whether the acquisition should proceed.

19 Execute an evidence-gated transaction sequence

At the first gate, the deal team defines the acquisition perimeter and builds ownership, rights and dependency maps. At the second, counsel conducts local screening, sector and competition analyses while technical advisers identify sensitive information and operational failure modes. At the third, the buyer tests bid economics under base, delay, bounded remedy and no-acceptable-remedy scenarios. These gates should occur before the firm price and unconditional financing commitment are set.

At signing, counsel and the board approve the contractual allocation of review risk, the notification plan, standstill controls and the remedy envelope. The team then submits complete information through the applicable process and maintains a controlled response room. Every authority request should be routed to the responsible legal and technical owner, with consistency checks across filings. The finance team updates the model when a new fact changes timing, operating cost or rights. The buyer should not quietly absorb a material change under an old approval.

Before completion, the team confirms every required clearance and consent, availability of financing, operability of any conditions, security and data controls, and the identity of the person authorised to take control. A closing checklist should distinguish legal receipt of approval from operational readiness to comply with it on day one. After closing, the operator should run the agreed monitoring, audit, incident and change-control processes. If an undertaking requires reporting, it needs budget, records and an accountable owner for as long as it applies.

The sequence remains conditional. Review clocks, information requirements and available remedies vary by law and the particular transaction. A cross-border energy deal can have multiple authorities with overlapping interests. A single programme office can coordinate the facts without pretending that one universal approval path exists. The investment committee should receive an updated decision record whenever a material assumption changes.

Author-developed transaction-management sequence. It is not a representation of statutory deadlines.

20 State the limits and the executable choice

The examples in this paper concern several jurisdictions with materially different laws. A UK entity notification rule cannot be carried over to a US real-estate purchase or a Canadian minority investment. The EU's newly adopted framework must be distinguished from the national rules applicable before its 2028 application date. Australian national-security concepts have their own definitions. Official guidance can also change. A transaction team needs current counsel advice in each relevant market and should verify the target's activities, beneficial ownership and contracts at the date of decision.

The worked acquisition is entirely invented. Its USD 1.2 billion proposed bid, USD 400 million bridge, 8% interest rate, six-month delay, USD 18 million setup, USD 4 million annual cost, seven-year period and 10% discount rate are hypothetical author assumptions. The calculation does not include taxes, customer attrition, regulatory fees, transaction expenses, refinancing, insurance, operating synergies or exit effects. No regulator, investor, lender or asset operator supplied these quantities. The amount cannot be used as a benchmark for an actual remedy.

The paper's central choice is practical. An investor should acquire a strategic asset only against a defined rights package and an operating design that can meet legal, technical and financing conditions. The board should know the maximum cost and loss of control it is willing to accept, the information required to confirm a proposed safeguard, and the point at which it will change price, restructure or walk away. A high-quality screening process cannot rescue a thesis that depends on rights the buyer may not lawfully or practically exercise.

For a specific deal, the next deliverable is a jointly maintained transaction file: ownership chart, rights map, dependency diagram, jurisdiction memorandum, approval calendar, safeguard design, lender response, cash-flow bridge and committee decision record. These should refer to the same transaction perimeter and version. A credible bid then rests on what the buyer can own, operate and finance after the review, rather than on the unqualified share percentage announced at signing.

References

1. UK Cabinet Office. National Security and Investment Act: details of the 17 types of notifiable acquisitions. Updated 6 February 2024. Accessed 6 October 2026. https://www.gov.uk/government/publications/national-security-and-investment-act-guidance-on-notifiable-acquisitions/national-security-and-investment-act-guidance-on-notifiable-acquisitions
2. UK Cabinet Office. Guidance on completing and registering a notification form. Updated 22 August 2026. Accessed 6 October 2026. https://www.gov.uk/government/publications/national-security-and-investment-notification-service-mandatory-voluntary-and-retrospective-forms/guidance-on-completing-and-registering-a-notification-form
3. US Department of the Treasury. The Committee on Foreign Investment in the United States. Accessed 6 October 2026. https://home.treasury.gov/policy-issues/international/the-committee-on-foreign-investment-in-the-united-states-cfius/
4. US Department of the Treasury. Is there a mandatory notification requirement for real estate transactions? Accessed 6 October 2026. https://home.treasury.gov/faq-item/international-affairs/is-there-a-mandatory-notification-requirement-for-real-estate-transactions
5. European Union. Regulation (EU) 2026/1386 on the screening of foreign investments in the Union. Official Journal, 26 June 2026. Accessed 6 October 2026. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32026R1386
6. European Commission. Investment screening: revision of the FDI Screening Regulation. Accessed 6 October 2026. https://policy.trade.ec.europa.eu/enforcement-and-protection/investment-screening_en
7. Government of Canada, Innovation, Science and Economic Development. Guidelines on the National Security Review of Investments. Revised 5 March 2025. Accessed 6 October 2026. https://ised-isde.canada.ca/site/investment-canada-act/en/investment-canada-act/guidelines/guidelines-national-security-review-investments
8. Government of Canada, Innovation, Science and Economic Development. What is the Investment Canada Act? Accessed 6 October 2026. https://ised-isde.canada.ca/site/investment-canada-act/en/what-investment-canada-act
9. US Department of the Treasury. Treasury Releases CFIUS Annual Report for 2025. 7 August 2026. Accessed 6 October 2026. https://home.treasury.gov/news/press-releases/sb0599
10. Australian Foreign Investment Review Board. Guidance Note 8: National Security. Accessed 6 October 2026. https://firb.gov.au/sites/firb.gov.au/files/guidance-notes/GN08_NationalSecurity_1.pdf
11. UK Cabinet Office. Applicability of the National Security and Investment Act 2021 to new build downstream gas and electricity assets. Accessed 6 October 2026. https://www.gov.uk/government/publications/national-security-and-investment-act-2021-guidance-for-new-build-downstream-gas-and-electricity-assets/applicability-of-the-national-security-and-investment-act-2021-to-new-build-downstream-gas-and-electricity-assets
12. UK Cabinet Office. National Security and Investment Act 2021 Annual Report 2025-26. Accessed 6 October 2026. https://www.gov.uk/government/publications/national-security-and-investment-act-2021-annual-report-2025-26/national-security-and-investment-act-2021-annual-report-2025-26-html
13. UK Cabinet Office. Notices of final orders under the National Security and Investment Act 2021. Accessed 6 October 2026. https://www.gov.uk/government/collections/notices-of-final-orders-under-the-national-security-and-investment-act-2021

About the Author

Chennakeshav (CK) is a corporate finance and investment banking executive with 25+ years of global experience in deal origination, structuring and execution across M&A, growth capital and corporate strategy. He has led value-creation mandates for founders, corporates and funds — bridging the boardroom view to hands-on execution and close.

His career spans Morgan Stanley, HSBC, Lloyds Banking Group, EWEC, ADQ portfolio companies and Emirates Growth Fund, across TMT, real estate, fintech, deeptech, cleantech, infrastructure and energy. He has partnered with C-suite leaders, private equity and venture funds, sovereign wealth funds and family offices to finance complex fund raises and scale-up ventures, and has led M&A due diligence, post-merger integration and business-transformation initiatives to create value.

At Matchpoint Partners he is Managing Partner, leading the firm's corporate finance, M&A and capital-raising practice. He holds an MBA from London Business School, an engineering degree from VTU and a Master of Laws (LLM, in progress) from UCL London.

An active start-up mentor, CK mentors at Techstars, DIFC FinTech Hive, Startup Grind, Founder Institute and IN5, serves as Entrepreneur Mentor in Residence (EMiR) at London Business School, and judges the Entrepreneurship World Cup.