1. When is mandatory NSI Act notification required?
The National Security and Investment Act 2021 imposes a mandatory notification regime over acquisitions of qualifying entities in 17 sensitive sectors (advanced materials, AI, civil nuclear, communications, computing hardware, critical suppliers to government, cryptographic authentication, data infrastructure, defence, energy, military and dual-use, quantum, satellite and space, suppliers to the emergency services, synthetic biology, transport). Where the trigger applies, the acquirer must notify before completion. The Investment Security Unit has 30 working days to accept the notification, with up to a further 30 + 45 working day call-in window. Source: legislation.gov.uk and gov.uk NSI Act 2021 guidance.
2. When does the ECCTA 2023 failure-to-prevent-fraud offence apply?
The new corporate offence under s.199 Economic Crime and Corporate Transparency Act 2023 came into force on 1 September 2025. It applies to 'large organisations' meeting two of three thresholds: more than 250 employees, more than £36 million turnover, or more than £18 million balance-sheet total. A target meeting the test must have 'reasonable procedures' to prevent fraud by associated persons - diligence should test the framework, board ownership, training cadence and policy currency.
3. What changed under DUAA 2025 Part 5 for data due diligence?
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. Part 5 (smart data / digital verification) commenced 5 February 2026. For diligence purposes, the UK GDPR / DPA 2018 spine is unchanged; what shifts is the regime for digital verification services, smart-data sharing and lawful-ground updates that may affect a target's data-processing activity. Confirm the target's processing maps cleanly to the updated regime. EU-UK adequacy was renewed on 19 December 2025 and now runs to 27 December 2031.
4. What is the current ICO data-protection fee?
The ICO fee rose on 17 February 2025 (SI 2025/63). Tier 1 (micro): £52 (£47 if paid by Direct Debit). Tier 2 (small): £78 (£73 by DD). Tier 3 (all others): £3,763 (£3,758 by DD). Diligence should evidence the current year's fee was paid and identify any historic non-payment. Source: ico.org.uk fee schedule.
5. Is W&I insurance worth procuring on a sub-£20m EV UK deal?
W&I uptake on sub-£20m EV UK deals is materially lower than on larger transactions but increasing - PE-backed groups now use it routinely on bolt-ons of £10m+ EV. Premium runs 0.7-1.5% of cover; retention is typically 0.5-1% of EV with a minimum claim threshold of £25-50k. Worth it where the seller is unwilling to give meaningful warranty cover, where seller covenant strength is thin, or where the buyer needs IC comfort on uninsured pre-completion risk. Underwriter requires clean DD reports, a complete disclosure letter and a defined retention.
6. What's the difference between a tax deed and the SPA warranty schedule?
The SPA contains tax warranties (a forward-looking statement that the target's tax position is as represented). The tax deed (separate document, governed by the same SPA) is an indemnity: the seller agrees to pay the buyer pound-for-pound for any pre-completion tax liability that crystallises post-completion. Diligence drives both: warranties cover what the seller knows, the deed covers what the seller could not foresee. Most pre-completion tax exposures sit inside the deed.
7. When does CMA merger jurisdiction apply?
The CMA has jurisdiction where the target has UK turnover above £70m, or where the merged enterprise will have 25%+ share of supply of any UK or UK-regional market and there is a substantial increment. Voluntary notification regime in the UK - the CMA can call deals in post-completion. Where jurisdiction is plausible but not clear, a pre-notification briefing with the CMA's mergers team is typical at the start of week 1.
8. How long does the FCA change-of-control approval take?
Under Part XII Financial Services and Markets Act 2000, an acquirer of control of an FCA-authorised firm must notify before the change. The FCA has 60 working days to determine the application (extendable in limited circumstances). The clock only starts on a complete application. Plan the completion long-stop to accommodate this - including the application-completeness window, total elapsed time from filing to consent is usually 75-90 working days.
This page is anchored to UK primary legislation and named regulator guidance only. Not legal advice. Confirm position with your appointed adviser before signing.