UK National Security Screening: What the NSI Act Means for Turkish Buyers of British Businesses

Since 4 January 2022, a buyer that wants to take control of a UK company active in a sensitive part of the economy has needed government approval before completion. The requirement comes from the National Security and Investment Act 2021. It applies to Turkish buyers in exactly the same way as to British ones. The Act also gives the government power to call in, and in the last resort to block or unwind, a much wider range of transactions for up to five years after they take place.

The first practical effect on a Turkish group is on the timetable. A mandatory notification adds weeks to a transaction even in a straightforward case, and a deal that is called in can take months. The more serious risk is legal: a notifiable acquisition completed without approval is void. Turkish acquirers in defence, electronics, energy and software are likely to be the most exposed, but the sector definitions are wide enough to catch businesses whose security relevance is not obvious.

We explain the rules as they stand in November 2026, including the changes the government announced in March 2026. We then deal with the Turkish merger control test that may apply to the same transaction. Readers considering a first investment in the UK may also find our guides to market entry between Türkiye and the UK and to legal due diligence in cross-border transactions useful.

1. Screening that does not depend on nationality

The Act created a standalone screening system, separate from merger control under the Enterprise Act 2002. It is run by the Investment Security Unit, which moved from the Cabinet Office to the renamed Department for Business, Innovation, Science and Trade under the machinery of government changes announced on 22 July 2026. It does not list friendly or unfriendly countries. The question in every case is whether a particular acquisition of control has given rise, or may give rise, to a risk to national security.

The government's annual report for the year to 31 March 2026 shows how the system works in practice. The Investment Security Unit received 1,324 notifications, of which 1,135 were mandatory, 147 voluntary and 42 applications for retrospective validation. Of the 1,220 notified acquisitions reviewed, 54 were called in, and six acquisitions that had not been notified were also called in. Defence accounted for 58% of notifications and 47% of call-ins. Of the four acquisitions withdrawn after call-in, one involved an acquirer associated with Türkiye.

The great majority of notified deals, 95.6% in that year, are cleared within the review period. The deals that are scrutinised cluster in defence, military and dual-use technology and supply to government. Turkish groups active in those sectors should plan for scrutiny from the outset.

2. Trigger events and the four routes to control

The Act applies to a "trigger event", which section 5 defines as a person gaining control of a qualifying entity or a qualifying asset. Section 8 sets out four ways of gaining control of an entity. The first is crossing a shareholding threshold, from 25% or less to more than 25%, from 50% or less to more than 50%, or from less than 75% to 75% or more. The second is crossing the same thresholds in voting rights. The third is acquiring voting rights that allow the person to secure or prevent the passage of any class of resolution governing the entity's affairs. The fourth is acquiring material influence over the entity's policy.

Material influence matters because it can arise well below 25%. The government's guidance gives the example of a right to appoint board members that enables the investor to influence the target's strategic direction. It also gives the example of a 20% shareholder that becomes the largest shareholder and, through its expertise in the sector, influences the other shareholders. The guidance refers to the Competition and Markets Authority's approach to material influence under the Enterprise Act. A Turkish investor taking a 20% stake with two board seats and strategic vetoes should assume that it may be acquiring control for the purposes of the call-in power. Our article on shareholders' agreements discusses how such rights are usually drafted.

Control can also be acquired indirectly. Under paragraph 3 of Schedule 1, an interest held through an unbroken chain of majority stakes is treated as held by the person at the top of the chain. A Turkish group that acquires a German or Dutch company with a UK subsidiary in a specified sector is therefore acquiring control of that UK subsidiary. Assets are covered as well. Under sections 7 and 9, gaining the ability to use or control land, tangible property or intellectual property, such as source code, designs or trade secrets, can be a trigger event. Asset acquisitions are never subject to mandatory notification, and the government expects to investigate them only rarely.

3. Qualifying entities, including Turkish ones

An entity formed in the UK is a qualifying entity whatever it does. Under section 7(3), an entity formed outside the UK is a qualifying entity if it carries on activities in the UK or supplies goods or services to people in the UK. The government's guidance says that this will generally include an overseas company that produces goods for export to a company in the UK. A Turkish company that exports components to British customers is therefore likely to be a qualifying entity. An acquisition of that company by another Turkish group, signed and completed in Istanbul, is a trigger event that the government could in principle call in.

The mandatory regime is narrower. Section 6(4) requires the specified description of entity to include activities carried on in the UK. Supplying goods into the UK from Türkiye is not enough by itself for mandatory notification. The guidance gives a regional office or a research and development facility in the UK as examples of carrying on activities there. The distinction is easy to miss and it matters. A purely Turkish deal will rarely be void for want of approval, but it can still be called in if the target's UK supplies are sensitive.

4. Mandatory notification in the seventeen sectors

A notifiable acquisition takes place when a person gains control through one of the first three routes in section 8 over a qualifying entity of a description specified in the Notifiable Acquisition Regulations. Material influence alone never triggers mandatory notification. The regulations cover seventeen areas: advanced materials, advanced robotics, artificial intelligence, civil nuclear, communications, computing hardware, critical suppliers to government, cryptographic authentication, data infrastructure, defence, energy, military and dual-use, quantum technologies, satellite and space technology, suppliers to the emergency services, synthetic biology and transport.

Each schedule defines the relevant activities in technical terms, and the outcome often turns on what the target actually does. A company that develops goods or services for defence purposes and sits in a chain of sub-contractors beginning with a government contractor falls within the defence schedule. One that holds a generation licence and owns or operates a generating asset of 100 megawatts or more falls within energy. One that creates or exploits intellectual property in processor designs falls within computing hardware. The analysis needs to be done on the target's real activities, using its contracts and product information, rather than on the description in its annual accounts.

The obligation falls on the acquirer. Under section 14, the acquirer must give a mandatory notice before gaining control, and the government may reject a notice that is incomplete. Internal reorganisations are not exempt. The government's guidance states that an internal reorganisation can be a qualifying acquisition where a new group company acquires control of a qualifying entity, even though the ultimate owner is unchanged. A Turkish group that moves its UK subsidiary under a new intermediate holding company may therefore need approval first.

Acquisition finance raises a related point. The guidance states that granting security over shares without transferring title is not a notifiable acquisition. A transfer of legal title to the lender or its nominee, as under a Scots law share pledge, requires clearance first if the company is within the regulations. Enforcement that gives a lender control is a separate event and has to be analysed when it happens.

5. A notifiable acquisition completed without approval

Section 13(1) provides that a notifiable acquisition completed without the approval of the Secretary of State is void. The consequence is not limited to the UK. A share transfer of a UK company completed in Türkiye, between Turkish parties, is equally void under English law if it was notifiable. Section 32 makes completion without approval a criminal offence, and section 52 applies the offence wherever it is committed and whatever the nationality of the person committing it. On conviction on indictment the maximum sentence is five years' imprisonment. Under section 41, a civil penalty can reach the higher of 5% of the business's worldwide turnover, including that of businesses it controls, and £10 million.

The way out is retrospective validation. Under section 16, a person materially affected by the fact that an acquisition is void may apply for a validation notice. In the year to March 2026, the government identified 42 potential offences of completing a notifiable acquisition without approval. It imposed no penalties. Instead, it required the parties to give reassurance that steps had been taken to prevent a recurrence. That enforcement record should not be taken as licence. A void acquisition can unsettle financing, security and the target's own corporate acts until it is validated, and the five-year time limit for call-in does not apply to a void notifiable acquisition.

6. Voluntary notification and the five-year window

Where an acquisition is not notifiable, the parties may give a voluntary notice under section 18. The government is not obliged to accept every voluntary notice, but if it accepts one it must decide within the review period whether to call the deal in. The alternative is to take the risk of a call-in later. Under section 2, a call-in notice may be given up to five years after the trigger event, and within six months of the government becoming aware of it. In FTDI, discussed below, the Divisional Court held that the six months run only once the Investment Security Unit knows of the trigger event and appreciates that it may call for investigation. Knowledge held only in another department does not count. The power also reaches acquisitions completed on or after 12 November 2020, which is how LetterOne's acquisition of January 2021, made before the Act came into force, came to be called in.

In our view, a voluntary notification is worth serious consideration when a Turkish buyer acquires material influence over a UK business in or near one of the seventeen sectors. It should also be considered when the target supplies government, or when the buyer has links that the government is likely to examine. A clearance obtained before completion closes off a risk that would otherwise run for up to five years, unless the information given was false or misleading. The decision should be taken early, because a voluntary notice filed shortly before completion leaves the parties choosing between delay and exposure.

7. The timetable

The guidance says that notification is generally appropriate once the terms are stable enough for the government to assess the deal and there is a good faith intention to proceed, which heads of terms, financing arrangements or board consideration may show. The process then has up to three stages. The government must first decide whether to accept the notification. In the year to March 2026, acceptance took a median of 11 working days for mandatory notifications and 13 for voluntary ones. Once a notice is accepted, section 14(9) gives the government a review period of 30 working days to clear the acquisition or call it in.

If the acquisition is called in, section 23 provides for an assessment period. The initial period is 30 working days. The government may extend it by an additional period of 45 working days, and then by voluntary periods agreed with the acquirer. Working days are counted excluding public holidays anywhere in the UK, and the clock stops while an information notice or attendance notice is outstanding. On the statutory periods alone, a notification that is called in and extended can take more than five months from filing to decision. In the year to March 2026, final orders took on average 69 statutory working days from call-in, and seven of the nine used the additional period. A long-stop date in the transaction documents should be set with that in mind. During the assessment period, section 25 also allows an interim order to prevent or reverse action that might prejudice the government's powers. The guidance gives as an example a requirement to stop progressing the acquisition until the assessment is complete.

8. How the government assesses risk

Section 3 requires the government to publish a statement about how it expects to use the call-in power. The current statement, published in May 2024, identifies three risk factors. Target risk concerns what the target does and could be used for. Acquirer risk concerns whether the acquirer has characteristics that suggest a risk from its having control. Control risk concerns the amount of control acquired.

The passages on acquirer risk are the most relevant to Turkish buyers. The statement says that the government will not make judgements based solely on an acquirer's country of origin, and that it does not regard all state-owned entities and sovereign wealth funds as inherently more likely to pose a risk. It does, however, consider an acquirer's ties or allegiance to a hostile state or organisation. It also looks at requirements placed on the acquirer by foreign governments, sanctions exposure, the source of funds and the identity of ultimate beneficial owners. It considers past behaviour too, including any attempt to obscure the identity of the investor through corporate structures.

One passage calls for particular preparation. Paragraph 38 of the statement says that the government looks at requirements placed on an acquirer by foreign governments, and notes that in some jurisdictions intelligence agencies can compel organisations to share data and give assistance. It names no country. A Turkish buyer of a sensitive target should nonetheless expect the question. Article 6(1)(b) of Law No. 2937 on the State Intelligence Services and the National Intelligence Organisation allows the Organisation to obtain information, documents, data and records from legal persons, and those asked may not refuse by relying on their own governing legislation. In our view the effective answer is structural: sensitive UK information should stay in the UK with UK-based staff and should not be held by the Turkish parent.

For a Turkish buyer, the practical consequence is that the government's view of the deal will be formed largely from the information the buyer gives it. A clear account of the ownership chain, of any state shareholding or state contracts, and of the group's dealings with sanctioned jurisdictions is likely to shorten the process. Gaps or inconsistencies are likely to lengthen it. Our guide to sanctions, beneficial ownership and cross-border payments covers the ownership questions that also arise here.

9. Final orders in practice

At the end of the assessment period, the government must either clear the acquisition by a final notification or make a final order. Under section 26(3), it may make a final order only if it is satisfied on the balance of probabilities that a trigger event has occurred or is in contemplation and that a risk to national security has arisen or would arise. It must also reasonably consider that the order's provisions are necessary and proportionate to prevent, remedy or mitigate that risk.

Most final orders impose conditions rather than prohibitions. In the year to March 2026, eight of the nine final orders allowed the acquisition to proceed on conditions, and one blocked it. The published notices show that orders have been made in acquisitions by US, German and UAE buyers as well as Chinese ones. Published notices describe conditions on information, physical and personnel security, on continuity of supply to UK government and defence prime contractors, and on keeping capabilities in the UK. A Turkish buyer should expect that a called-in acquisition in the defence sector may be cleared subject to conditions of this kind. It should consider before signing whether it could live with them.

Final orders are public. Subject to limited exceptions, section 29 requires the government to publish a notice naming those bound by the order, describing the trigger event and summarising the order and the reasons for it. Under section 26(6), an order can reach conduct outside the UK only where the person is a UK national or resident, a body formed under UK law or someone carrying on business in the UK. A UK target and a UK acquisition vehicle are within that reach.

10. Challenging a decision

Decisions under the Act are challenged by judicial review. Section 49 requires the claim form to be filed within 28 days of the day after the grounds first arose, unless the court considers that exceptional circumstances apply. That is much shorter than the usual three months. In both reported challenges, the government relied on closed material.

The first cases show the courts giving considerable weight to the government's assessment. In R (L1T FM Holdings UK Ltd) v Chancellor of the Duchy of Lancaster [2024] EWHC 2963 (Admin), the High Court dismissed a challenge to an order requiring LetterOne to divest the fibre broadband company Upp. The risk identified arose from the vulnerability of the group's ultimate beneficial owners to leverage by the Russian state. The appeal was confined to compensation. In [2025] EWCA Civ 1528, the Court of Appeal held that Article 1 of the First Protocol to the European Convention on Human Rights did not require compensation beyond the price obtained in the forced sale. It emphasised the wide margin of judgment in matters of national security and the availability of financial assistance under section 30. In R (FTDI Holding Ltd) v Chancellor of the Duchy of Lancaster [2025] EWHC 1922 (Admin), the Divisional Court rejected every ground of challenge to a divestment order but one. It held that the order's largely formulaic statement of reasons did not comply with section 28(4)(d), but that this did not invalidate the order because the minister in fact had sufficient reasons.

A Turkish buyer's best opportunity to affect the outcome is therefore during the assessment, through representations and proposed remedies.

11. Changes announced for 2026

The Notifiable Acquisition Regulations have not been amended in substance since January 2022. The government consulted on revised sector definitions between 22 July and 14 October 2025, and published its response on 12 March 2026. It decided to create a new schedule for the water sector. It will narrow the critical minerals, semiconductors, artificial intelligence and communications schedules to reduce low-risk notifications. It will also clarify the critical suppliers to government, data infrastructure, energy and emergency services schedules. The minister said that secondary legislation would be laid later in 2026. The annual report adds that forthcoming legislation will exempt certain acquisitions from mandatory notification.

At the date of this article, we have not seen the amending regulations published on legislation.gov.uk. Until they are made and in force, the 2021 regulations apply as they stand. A Turkish buyer negotiating a transaction now should therefore analyse the target under the current schedules. It should also check whether the proposed changes would bring the target into, or take it out of, the mandatory regime before completion.

12. Turkish merger control on the same transaction

A UK acquisition by a Turkish group may also require clearance from the Turkish Competition Authority. Under Article 7 of the Law on the Protection of Competition No. 4054, transactions above the thresholds set by the Competition Board acquire legal validity only with the Board's permission. The thresholds are in Communiqué No. 2010/4, as amended by Communiqué No. 2026/2, which came into force on 11 February 2026.

Clearance is now required where the parties' combined turnover in Türkiye exceeds TL 3 billion and at least two of them each have Turkish turnover above TL 1 billion. It is also required where, in an acquisition, the target's Turkish turnover exceeds TL 1 billion and at least one other party's worldwide turnover exceeds TL 9 billion. The lower threshold of TL 250 million for the target applies only to technology undertakings resident in Türkiye. A UK technology target with modest Turkish sales will therefore usually fall below the thresholds. A UK target with a substantial Turkish customer base may not.

Where Turkish clearance is required, closing without it exposes the acquirer to an administrative fine of one per thousand of its annual gross revenue under Article 16, and Article 11 allows the Board to order the transaction unwound if it significantly impedes competition. The two regimes run separately, with different tests, timetables and authorities. The transaction documents should make both approvals, where required, conditions to completion.

13. Structuring the transaction

The analysis should start before the heads of terms. The buyer needs to know whether the target carries on activities within any of the seventeen schedules, whether the stake or rights it is acquiring cross a statutory threshold and whether the deal will also be notifiable in Türkiye or elsewhere. That requires information from the target about its products, customers, government contracts and security clearances. That enquiry belongs in legal due diligence.

Where approval is required, the share purchase agreement should make clearance a condition precedent. It should set a long-stop date that allows for a call-in, and allocate the risk of conditions that the buyer is not willing to accept. Sellers will often ask for a commitment to accept remedies short of a prohibition. Buyers should limit that commitment to conditions they have assessed in advance. The parties should also agree how they will deal with information requests, since the government may ask for internal documents of the Turkish parent.

Approval under the Act does not displace other requirements. The government's guidance confirms that export licensing by the Export Control Joint Unit and the Takeover Code continue to apply, that listed companies remain subject to disclosure under the UK Market Abuse Regulation, and that merger control remains a separate matter for the Competition and Markets Authority.

The notification itself deserves care. It is a statement to a government department. Section 34(3) makes it an offence to supply information that the person knows, or is reckless as to whether, is false or misleading in a material respect. Under section 22, a decision affected by such information can be reconsidered. The description of the group's ownership, state links and international business should be consistent with what the group says elsewhere, including to banks, auditors and other regulators.

The notification also carries personal data. Under the prescribed form in SI 2021/1272, the notice must give the full name, date of birth and position of each member of the acquirer's board and state whether each is a politically exposed person. Where those details come from Türkiye, sending them to the UK is a transfer abroad under Article 9 of the Personal Data Protection Law No. 6698, and the basis for it should be settled before filing. Section 54 also allows the government to share information received under the Act with overseas public authorities for specified purposes. Our KVKK compliance guide explains the transfer rules.

14. A worked example

A Turkish industrial group based in Ankara manufactures thermal imaging systems for civilian and defence customers. It agrees to buy 60% of the shares in a company in Hampshire that designs infrared sensors and supplies them to the prime contractors of the UK Ministry of Defence. The price is £40 million. The UK company also holds export licences and employs engineers with security clearances.

The acquisition of 60% takes the buyer from 50% or less to more than 50%, and the target's work falls within the defence and military and dual-use schedules. The transaction is a notifiable acquisition. The buyer must file a mandatory notice and wait for approval before completion. If it completes first, the share transfer is void and the buyer commits an offence.

The buyer files with a full description of its ownership, its contracts with the Turkish defence procurement authority and its export markets. The government accepts the notification after two weeks and calls the deal in at the end of the review period. During the assessment period, the buyer proposes that classified information remain with UK-based, security-cleared staff, that one UK director with clearance sit on the target's board, and that supply to the UK prime contractors be maintained. Those proposals track the information, personnel security and supply conditions described in published final orders. Because the parties set a long-stop date of eight months, the deal survives the timetable.

The target sells sensors worth TL 200 million a year in Türkiye. That is well below the TL 1 billion threshold, so no Turkish merger filing is needed. Two years later, the group plans to move its 60% stake into a new holding company in the Netherlands. That internal reorganisation is itself a notifiable acquisition. It must be notified and approved before the shares are transferred, even though the ultimate owner does not change.

Conclusion

Any acquisition of a UK business in a sensitive sector now has to be tested against the Act. Whether approval is a condition of a valid completion depends on whether the target's actual activities fall within the seventeen schedules. Where approval is not required, the remaining question is whether the call-in risk justifies a voluntary notice. In defence and technology transactions, a Turkish buyer also has to decide in advance which conditions it could accept.

Our advice is to build the Act into the transaction timetable from the first heads of terms. The ownership and state-link information the government will ask for should be prepared alongside due diligence. The transaction documents should deal expressly with call-in, conditions and the long-stop date. Internal reorganisations of UK holdings need the same attention, because they fall within the mandatory regime even though nothing changes at the top of the group.

How Terziolu & Partners Can Assist

Terziolu & Partners advises Turkish groups on acquisitions in the UK within our international business and investment work. That includes the Turkish side of due diligence, the preparation of ownership and group information for notifications, Turkish merger control filings, and the negotiation of conditions and long-stop provisions through our corporate and commercial practice.

Where a transaction requires a notification in the UK or engagement with the Investment Security Unit, we coordinate the Turkish and English workstreams between Istanbul and London through our cross-border legal coordination work, with appropriately qualified counsel in each jurisdiction. Contact us to assess a proposed acquisition or reorganisation.

Selected Legislation, Authorities and Materials

United Kingdom

National Security and Investment Act 2021: sections 1 and 2 (call-in and time limits), 3 (statement), 5 to 9 (trigger events, notifiable acquisitions, qualifying entities and assets, control), 13 and 14 (approval and mandatory notification), 16 (retrospective validation), 18 (voluntary notification), 23 (assessment period), 25 (interim orders), 26, 28 and 29 (final orders and their publication), 30 (financial assistance), 32, 34, 39 and 41 (offences and penalties), 49 (judicial review), 52 (extra-territorial application) and 54 (disclosure of information).

National Security and Investment Act 2021, Schedule 1: interests and rights, including indirect holdings through majority stakes.

National Security and Investment Act 2021 (Notifiable Acquisition) (Specification of Qualifying Entities) Regulations 2021 (SI 2021/1264): the seventeen specified areas.

National Security and Investment Act 2021 (Prescribed Form and Content of Notices and Validation Applications) Regulations 2021 (SI 2021/1272): content of a mandatory notice.

Statement for the purposes of section 3 (May 2024): target, acquirer and control risk.

Guidance on acquisitions (updated July 2026): thresholds, indirect acquisitions, internal reorganisations and timetable.

Acquisitions outside the UK: foreign entities and assets.

The National Security and Investment Act alongside regulatory requirements: export control, the Takeover Code, market abuse rules and merger control.

National Security and Investment Act 2021: Annual Report 2025-26: notifications, call-ins, final orders and enforcement for the year to 31 March 2026.

Consultation on the Notifiable Acquisition Regulations and government response (12 March 2026): proposed changes to the sector schedules, including a new water schedule.

Notices of final orders under the National Security and Investment Act 2021: published final orders and their conditions.

Machinery of government changes: fact sheet (22 July 2026): transfer of the Investment Security Unit to the Department for Business, Innovation, Science and Trade.

R (L1T FM Holdings Ltd) v Chancellor of the Duchy of Lancaster [2025] EWCA Civ 1528: no compensation required beyond the sale price.

R (L1T FM Holdings UK Ltd) v Chancellor of the Duchy of Lancaster [2024] EWHC 2963 (Admin): challenge to the divestment order dismissed.

R (FTDI Holding Ltd) v Chancellor of the Duchy of Lancaster [2025] EWHC 1922 (Admin): challenge to a divestment order rejected.

Türkiye

Law on the Protection of Competition No. 4054: Articles 7 (mergers and acquisitions requiring permission), 11 (unnotified transactions) and 16 (administrative fines).

Communiqué No. 2026/2 amending Communiqué No. 2010/4 on mergers and acquisitions requiring Competition Board permission (Official Gazette No. 33165, 11 February 2026): current turnover thresholds and the rule for technology undertakings resident in Türkiye.

Personal Data Protection Law No. 6698 (KVKK): Article 9 (transfers abroad).

Law on the State Intelligence Services and the National Intelligence Organisation No. 2937: Article 6.