1. When is mandatory NSI Act notification required?
The National Security and Investment Act 2021 imposes a mandatory notification regime over acquisitions of qualifying entities in 17 sensitive areas (advanced materials, advanced robotics, AI, civil nuclear, communications, computing hardware, critical suppliers to government, cryptographic authentication, data infrastructure, defence, energy, military and dual-use, quantum technologies, satellite and space technologies, suppliers to the emergency services, synthetic biology, transport). Where the trigger applies, the acquirer must notify and obtain approval before completion. There is no fixed deadline for accepting a notification (the Act says as soon as reasonably practicable); once it is accepted, the government has a 30-working-day review period to call the deal in. A called-in deal has a 30-working-day assessment period, extendable by 45 working days and further by agreement. On 12 March 2026 the government confirmed it will add Water as a new area and split out Semiconductors and Critical Minerals, taking the list to 19; check whether the amending regulations are in force before you sign. Source: NSI Act 2021 ss.14 and 23 (legislation.gov.uk) and the gov.uk consultation response.
2. When does the ECCTA 2023 failure-to-prevent-fraud offence apply?
The new corporate offence under s.199 Economic Crime and Corporate Transparency Act 2023 came into force on 1 September 2025. It applies to 'large organisations' meeting two of three thresholds: more than 250 employees, more than £36 million turnover, or more than £18 million balance-sheet total. A target meeting the test must have 'reasonable procedures' to prevent fraud by associated persons - diligence should test the framework, board ownership, training cadence and policy currency.
3. What changed under DUAA 2025 Part 5 for data due diligence?
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. Part 5 (data protection and privacy) amends UK GDPR, the DPA 2018 and PECR, and most of it commenced on 5 February 2026 (SI 2026/82), with the data-subject complaints provisions following on 19 June 2026. The changes touch recognised legitimate interests, purpose limitation, automated decision-making, subject access searches and international transfers. Smart data (Part 1) and digital verification services (Part 2) are separate regimes. Diligence should confirm the target's privacy notices, ROPA and transfer mechanisms reflect the amended law. EU-UK adequacy was renewed on 19 December 2025 and now runs to 27 December 2031.
4. What is the current ICO data-protection fee?
The ICO fee rose on 17 February 2025 (SI 2025/63). Tier 1 (micro): £52 (£47 if paid by Direct Debit). Tier 2 (small): £78 (£73 by DD). Tier 3 (all others): £3,763 (£3,758 by DD). Diligence should evidence the current year's fee was paid and identify any historic non-payment. Source: ico.org.uk fee schedule.
5. Is W&I insurance worth procuring on a sub-£20m EV UK deal?
W&I cover is bought from an underwriter, through a broker, and priced as a premium on the limit of cover; the retention (the loss the insured bears first) and any de minimis are negotiated on each policy. No public rate card exists, so get a broker's indication early. Worth it where the seller is unwilling to give meaningful warranty cover, where seller covenant strength is thin, or where the buyer needs IC comfort on uninsured pre-completion risk. Underwriter requires clean DD reports, a complete disclosure letter and a defined retention.
6. What's the difference between a tax deed and the SPA warranty schedule?
The SPA contains tax warranties (a forward-looking statement that the target's tax position is as represented). The tax deed (separate document, governed by the same SPA) is an indemnity: the seller agrees to pay the buyer pound-for-pound for any pre-completion tax liability that crystallises post-completion. Diligence drives both: warranties cover what the seller knows, the deed covers what the seller could not foresee. Most pre-completion tax exposures sit inside the deed.
7. When does CMA merger jurisdiction apply?
Since 1 January 2025 (Digital Markets, Competition and Consumers Act 2024), the CMA has jurisdiction where the target's UK turnover exceeds £100m; where the merger creates or increases a share of supply of 25% or more in the UK or a substantial part of it; or, under the hybrid test, where one party has a 33% share of supply and UK turnover above £350m and the other has a UK nexus. A merger where each party's UK turnover is £10m or less falls outside the CMA's jurisdiction. Voluntary notification regime in the UK - the CMA can call deals in post-completion. Where jurisdiction is plausible but not clear, a pre-notification briefing with the CMA's mergers team is typical at the start of week 1.
8. How long does the FCA change-of-control approval take?
Under Part XII Financial Services and Markets Act 2000, an acquirer of control of an FCA-authorised firm must notify before the change. The FCA has an assessment period of 60 working days, starting when it acknowledges receipt of a complete notice, and it can interrupt that period once to request information. Plan the completion long-stop to cover the completeness check, the 60 working days and any interruption.
This page is anchored to UK primary legislation and named regulator guidance only. Not legal advice. Confirm position with your appointed adviser before signing.