China’s New National Security Review

Modern China has always kept close regulatory watch over inbound investment, but no less notable is its overall consistent trend of opening-up, subject to an increasingly complex legal framework. The frustrating effects of the COVID-19 pandemic should not obscure the legal developments for facilitating foreign investment into China's market through mergers, acquisitions and other avenues.

The Foreign Investment Law and its implementing regulations came into effect in January 2020, simplifying the rules for foreign-invested enterprises (FIEs) and proclaiming pre-establishment equal treatment between foreign and domestic entities. The so-called negative lists are updated every year (most recently on 1 January 2022) to include fewer industries in which inbound investment is prohibited or restricted, and China is regularly paring down import and export restrictions.

One apparent counter-example is the Measures on Foreign Investment Security Review (Measures), effective since January 2021: as the Measures elaborate a process for a PRC government mechanism to screen certain inbound investments (for so-called security review), they have been decried as a restriction against foreigners acquiring or merging with business interests in China. Although the Measures add to the PRC legal framework for regulating inbound investment, they do not mark the end of cross-border M&A activity in China. In fact, they may be a sign that PRC regulators anticipate, and perhaps even generally welcome, more foreign investment.

As an initial matter, China has had a security review since 2011. In hindsight, its establishment indisputably aligned with more, not less, inbound investment: it has nearly doubled in the decade since then, compared to the decade before. Furthermore, many other countries have analogous frameworks (eg, the long-established CFIUS review in the USA, the EU's new “minimum requirement” Regulation (EU) 2019/452 and the UK's National Security and Investment Act 2021). Finally, the Measures make only modest additions to China's pre-existing security review regime – for better or worse, it was and largely remains vague – and the additional specifics may stand for greater rule of law, predictability and efficiency in the regime.

The “foreign investment” under the scope of the Measures is defined as investment activities conducted – “directly or indirectly” – by any foreign investor within mainland China, whether a merger, acquisition, establishment of an FIE or investment through “other means”. Such breadth is common in PRC legal provisions, and some types of investment activities (eg, domestic re-investment by an existing FIE) may end up rarely subject to security review. The scope of security review is narrowed by the rule that it applies only to foreign investments that either:

The scope thus includes numerous industries, as well as “other important areas related to national security”, though the latter reflects a standard (yet rarely applied) PRC catch-all provision. Recently, there have been indications that industries of present focus for PRC regulators include those with significant involvement in semiconductors or data.

More problematic is the lack of any general indication of how the qualifier “important/key” is to be assessed. On the other hand, the Measures do provide a definition (albeit an open-ended definition) of “actual control”:

In sum, the security review even under the dreaded Measures remains a vague and highly discretionary process. Thus, the Measures do not automatically render every foreign merger or acquisition in China subject to security review, which would be impracticable even if it were sought by some regulators.

In fact, the additional rules and other specifics may free some foreign investments from the risk, under the old framework, of being subject to security review. For example, an acquisition that clearly falls neither within any national defence industry nor results in a foreign party obtaining actual control is highly unlikely to be subject to security review. Also excluded are purchases, by foreign investors, of domestic enterprises equity via stock exchanges (and certain other securities trading venues).

As for the otherwise broad scope of the new security review, parties need not navigate it blind. Cases under the old security review, rules and cases under related or analogous reviews (eg, merger review and cybersecurity review) and insights into the attitudes of the relevant regulators, as well as the PRC government's wider policies can all provide pointers not only on the applicability of the security review to particular transactions (eg, the interpretation of the term “important/key” but also on navigating the review procedures).

The Measures provide a timeline for the stages of security review, totalling at most three-and-a-half months. However, the timeline is subject to extension for necessary document supplementation and “special circumstances”, and so far, experience shows that while some cases are cleared in around three months (and maybe less time), others drag on for much longer and, at least partly as a result, are scuttled. It may be that kinks in the procedures are still being worked out, and that the timelines in the Measures will be followed more closely in the near future, or it may be that parties (and their counsel) need to further develop strategies to help the regulators effectively and efficiently apply the new security review.

One thing is certain: the Measures afford both regulators and businesses more resources to assess and deal with (potential) PRC national security concerns arising from particular inbound investment. Whether that will lead to less cross-border M&A activity in China is as much a matter of foreign parties’ approaches (or abstention) as anything else.