Luxembourg adopts national filtering mechanism for foreign direct investments likely to undermine security or public order

On 13 June 2023, the Luxembourg Parliament voted the law establishing a mechanism for the national screening of foreign direct investments likely to undermine security or public order ("Law" – for a link to the text as currently available (in French) see here). The Law implements Regulation (EU) 2019/452 establishing a framework for the screening of foreign direct investments into the Union, which contains essential elements of the framework for the screening of such investments by Member States and introduces co-operation at EU level in the field. 

The Law will significantly impact the timing and proceedings of in-scope M&A transactions.

Material scope: The screening mechanism applies to foreign direct investments ("FDI"), excluding portfolio investments (i.e. acquisitions of securities with the intention of making a financial investment and not allowing for the exercise of control), which could undermine security or public order, in a Luxembourg entity carrying out critical activities in Luxembourg (Article 2(1) of the Law).

Pursuant to Article 2(2) of the Law, critical activities are, for example, (1°) the development, operation and trading of dual-use goods, (2° to 6°) certain activities in the energy, transport, water, health and communication sectors, (7°) in the data processing or storage sector: computer facilities for data processing, hosting of information services and internet portals; technologies concerning artificial intelligence, semiconductors, cyber security, (8° and 9°) certain activities in the aerospace and defence sectors, (10) in the financial sector: the activities of the central bank as well as the infrastructures and systems for the exchange, payment and settlement of financial instruments, or (11°) in the media sector: publishing, audiovisual and broadcasting activities.

In addition, critical activities also include research or production activities directly related to a critical activity, activities that may allow access to sensitive information, including personal data, directly linked to a critical activity or related activities likely to allow access to the premises in which a critical activity is carried out (Article 2(3) of the Law).

An FDI is defined in Article 1(6) of the Law as an investment of any kind by a foreign investor, aiming to establish or maintain lasting and direct links between the foreign investor and a Luxembourg entity for which the relevant funds are intended, thus allowing the foreign investor to participate, acting alone, in concert or through an intermediary, in the control of this entity, with a view to exercising a critical activity in Luxembourg. 

Personal scope: A foreign investor is a natural person or an undertaking of a country outside the European Economic Area ("EEA") intending to make or having made a foreign direct investment (Article 1(5) of the Law).

Control is defined (Article 1(1)) as (i) the fact of, directly or indirectly, having the majority of the voting rights of shareholders or partners of a Luxembourg legal entity; or having the right to appoint or dismiss the majority of the members of its administrative, management, or supervisory body when also being a partner or shareholder; or being a shareholder or partner controlling the majority of the voting rights by virtue of an arrangement concluded with the other shareholders or partners of such an entity; or (ii) the fact of, directly or indirectly, exceeding the threshold of 25% of voting rights of such an entity.

Furthermore, it is not sufficient for the direct acquirer to be established in the EEA to be out of scope of the Law. In its comments of 22 March 2022, the Council of State indicates that the notion of "control" in the context of the definition a foreign investor must be interpreted in view of a possible circumvention of the screening mechanism. It must be assessed “with regard to the foreign investor acting alone, in concert or through the interposition of a company, even one established in another Member State of the European Union or the European Economic Area”.

Temporal scope: If a Luxembourg FDI notification is required, the foreign investor must submit a notification to the Minister of the Economy before the FDI is made ("avant la réalisation"), i.e., before completion, or within 15 calendar days in the event the threshold of 25% voting rights in the Luxembourg target entity is exceeded as a result of events modifying the distribution of the capital (Article 3 of the Law).

Duration of the review procedure: The Minister decides whether the FDI must be subject to the screening procedure within 2 months of receipt of the notification. The Law defines certain criteria to assess whether the FDI may pose a threat to security or public order in Luxembourg. The duration of the screening procedure (phase II) cannot exceed 60 calendar days after it is triggered. These periods may be suspended in case of an incomplete notification or supplementary information requests by the Ministry. The FDI cannot be completed before the authorisation decision is adopted.

Screening criteria: The screening criteria for determining if an FDI may pose a threat to security or public order are set out in Article 7 of the Law. The following are considered, for example, the FDI's potential effects on (1°) the integrity, security and continuity of supply of critical infrastructure (…) (3°) the supply of essential inputs, including raw materials, and food security; (4°) access to sensitive information, including personal data, or the ability to control such information; (…). 

In particular, the following may also be taken into account: e.g., the fact that the foreign investor is directly or indirectly controlled by the government of a third country or the fact that there is a serious risk that the foreign investor is engaged in illegal or criminal activities.

Potential sanctions: Completion without prior notification or without authorisation obtained in the context of the screening decision of an in-scope FDI may trigger the suspension of voting rights attached to the FDI and to the securities held, directly or indirectly, by the foreign investor which exceed the threshold of 25% voting rights until the situation is regularised. The foreign investor can be ordered to modify the transaction or to have the previous situation restored at his own expense (Article 9 (1) of the Law).

Where the voting rights of the Luxembourg-law entity have been exercised notwithstanding a suspension of their exercise, all or part of the decisions of the general meeting can be declared void if, without the voting rights illegally exercised, the quorum of either presence or majority required for the said decisions had not been met (Article 9 (1) of the Law). 

Administrative fines of up to 5 million EUR in the case of legal entities may be imposed if an order to suspend voting rights or modify or undo an operation is not respected. The sanction must take into account all relevant circumstances, including, e.g., the degree of responsibility of the foreign investor or the advantage obtained through the violation of the relevant order, previous violations, or the consequences for critical infrastructures at issue (Article 9(7) and (10) of the Law).

Entry into force and what's next?  According to its Article 19, the Law enters into force on the first day of the second month following its publication in the Luxembourg Official Journal. The law has been published on 18 July 2023. The new regime will enter into force on 1 September.

Considering certain areas of uncertainty in the Law, e.g., as to its potentially wide scope, it is expected that the Ministry of Economy will provide guidance to assist relevant entities in complying with the new framework.