National Security Screening In Cross-Border M&A - The Indian Approach

Author: LawSphereX

Category: General Law

Published: 2026-08-23T20:38:26.132786+00:00

Updated: 2026-08-26T17:10:24.171+00:00

NATIONAL SECURITY SCREENING IN CROSS-BORDER

M&A: THE INDIAN APPROACH

Era Gangwar, Thakur Ramnarayan College of Law, Mumbai, India

ABSTRACT

This paper analyzes the interplay of national security review and crossborder M&A regulations in India. First, the paper maps out the development of FDI-scrutiny mechanisms in India, particularly the changes introduced through Press Note No. 3 issued in 2020 (PN3) as well as its broader context provided by the Foreign Exchange Management Act, 1999 (FEMA)1, the Companies Act, 20132, and sector-specific security clearance requirements. Further, the paper analyses the implications of national security considerations on timelines and transaction structuring in the cross-border M&A process and their impact on foreign investment flows into India. Thereafter, India’s regulatory regime is contextualized against the trend of “FDI-screening” in the US and EU jurisdictions3.

Keywords: National security screening, cross-border M&A, FDI-screening, India, FEMA, border-country investment, national-security-based review. 1 Press Note 3 (2020 Series), Dep’t for Promotion of Indus. & Internal Trade, Ministry of Commerce & Indus. , Gov’t of India (Apr. 17, 2020).

2 Companies Act, No. 18 of 2013, Acts of Parliament, 2013 (India).

3 Regulation (EU) 2019/452 of the European Parliament and of the Council of 19 March 2019 Establishing a Framework for the Screening of Foreign Direct Investments into the Union, 2019 O.J. (L 79I) 1.

Introduction Merger and acquisition deals involving cross-border operations have increasingly been examined using the national security framework due to the increasing emphasis on prioritizing non-economic considerations in investment reviews4. There are regulations in India regulating mergers and acquisitions according to the Competition Act of 20025. The act seeks to ensure that any merger does not result in detrimental effects on competition in India. The Competition Commission of India implements these regulations to curb mergers that may have negative effects on the competition. The major objective of the regulation is to prevent mergers that may be detrimental to India's landscape. Generally, there are factors involved in the evaluation of the mergers. The Competition Commission of India is allowed to implement conditions to mitigate competition-related problems.

The global environment is dynamic; therefore, India must also consider national security in cases where foreign entities seek to merge with local companies. The Competition Act of 2002 largely considers consequences. However, the country must also consider the national security aspect in evaluating mergers of foreign entities. This paper explores the changes in India's laws and regulations with respect to national security when conducting cross-border mergers. It will also look at how the Competition Act works with laws like the Foreign Exchange Management Act to check if India’s rules are strong enough to protect national security. The paper will also check if India’s rules are good enough to deal with risks like threats to critical infrastructure and sensitive technologies. It will look at if the rules can protect India’s assets and data.

India’s rules for mergers also think about security, like other countries, such, as South Africa. India's national-security-based screening system follows an integrated approach that includes: (i) a generalized system of screening for national security under the policy umbrella of FDI in general terms6, mainly based on Press Note 3 (2020 series) along with the channeling role of the Department for Promotion of Industry and Internal Trade (DPIIT); and (ii) screening at the sector-specific level, conducted by the Ministry of Home Affairs and other relevant line ministries. 7 The dual nature of the approach affects the structure of international M&A transactions in India, in terms of designing and structuring deals, conducting due diligence, and managing investors from 'border-sharing' countries. 4 Simon Lorfing, National Security and Foreign Investment Screening, 21 J. World Inv.

& Trade 1 (2021).

5 Competition Act, No. 12 of 2003, Acts of Parliament, 2003 (India).

6 Consolidated FDI Policy, Dep’t for Promotion of Indus. & Internal Trade (as amended).

7 Competition Comm’n of India, Combination Regulations, 2011.

This paper will argue that while India’s existing national security screening system for international M&A can be normatively justified, it needs to become more transparent and streamlined for meeting the demands of both national security and competitiveness.

2. Conceptual Framework: National Security and Investment Screening

2.1 National security as a ground for investment screening

National security in the context of cross-border mergers and acquisitions can be seen as the defense of the state’s ability to protect its territory, sovereignty, civilian infrastructure, and critical IT infrastructure against any adverse foreign influence. Investment-screening policies treat specific industries such as those related to defense, telecommunications, critical infrastructure, and dual-use technology as “sensitive” requiring increased screening.8 In their analysis, the screening agencies review, among other aspects, the background and reputation of the foreign investor, the target industry, the extent of control intended, and the effect on sensitive assets related to national security.

2.2 FDI screening and cross-border M&A

FDI screening legislation is not the same as competition or foreign exchange control policy regimes, although in many cases they co-exist. Whereas competition regimes (e.g., the Competition Commission of India)9 are geared towards assessing issues relating to market structure and anti-competitive practices, FDI-screening regimes deal with issues relating to strategic security, technological dependency, and geo-political stability. In cross-border M&A transactions, this means that while the merger may be approved through the competition law regime, it may still be unravelled by national security screeners.

2.3 Comparative Anchoring: India, US, and EU

Internationally, India’s adoption of the principle of explicit security-based screening is part of a larger trend. Both the Committee on Foreign Investment in the United States (CFIUS), which operates in the US10, and the FDI-screening regulation (Regulation 2019/452), which covers the entire EU jurisdiction11, have institutionalized the ex ante or ex post screening of foreign

8 Org. for Econ. Co-operation & Dev. (OECD), FDI Screening in Times of Crisis (2020).

9 Competition Act, supra note 7.

10 50 U.S.C. § 4565 (Committee on Foreign Investment in the United States).

11 Regulation (EU) 2019/452, supra note 4.

investments based on national-security interests. India, however, lacks any independent “investment-screening legislation” along the lines of the US’s CFIUS or the EU regulation, as its investment screening is an integral part of the policy-driven framework in which DPIIT operates.12

3. India’s Legal and Institutional Architecture

3.1 FDI-Policy and Press Note 3 (2020)

India’s FDI policy regime, run under the supervision of DPIIT in the Ministry of Commerce and Industry, constitutes the backbone of India’s security-linked screening framework. With the passage of Press Note 3 in 202013, a groundbreaking stipulation was imposed, requiring that all investment proposals made by firms domiciled in, or citizens of, countries that share a common land border with India should be vetted by the Government, and not be eligible for the automatic route. PN3 is warranted because of the possibility that these investments might be “opportunistic” in nature or could present national security concerns in light of the geopolitical conflicts that occurred.

As a result, any share sale, merger and acquisition (M&A), and subscription to additional shares by foreign investors who come from a border-sharing nation must be directed to the Department for Promotion of Industry and Internal Trade (DPIIT). In addition, if deemed necessary, such transactions will be referred to the Ministry of Home Affairs (MoHA). 14

3.2 Security Clearance for Sectors

In specific cases, there are clear regulations and policies within the FDI policy framework where security clearance is required before investments in particular sectors.15 Some examples of these include broadcasting and telecommunications services, private security firms, and civil aviation. In cases where there are investments that belong in a “sensitive” sector and come from a border-sharing nation, a two-tier process could occur: security clearance for the specific sector and approval from the government through the PN3 mechanism. These parallel procedures may overlap with the jurisdiction of various ministries and agencies that evaluate

12 Foreign Exchange Management (Non-Debt Instruments) Rules, 2019, G.S.R. 777(E) (India).

13 Press Note 3 (2020 Series), supra note 1.

14 MHA Guidelines

15 Ministry of Home Affairs, Gov’t of India, Guidelines for Grant of Security Clearance (as amended).

the investments based on different standards for determining “national security impact.”

3.3 The role of FEMA and other legislations

The FDI-policy and PN3 constitute the core of the security-screening process, but the crossborder M&A is also part of the larger FEMA-based regime. 16 The FEMA regulates capital account transactions like share purchases, investments in equities, and intra-group fund transfers for maintaining macroeconomic stability and meeting foreign exchange control purposes17. The RBI guidelines on transfer of securities by persons not residing in India represent the technical aspect under which the cross-border M&A takes place, whereas the Companies Act, 201318 and SEBI regulations19 address corporate restructuring and listed companies issues. Nevertheless, national-security-screening works at a higher level than FEMA compliance, often overriding or qualifying the compliant structure of the transaction.

Even if the transaction is FEMA-compliant and competition clearance-ready, rejection of security clearance or PN3linked government approval may frustrate or modify the M&A.

3.4 Institutional design and opacity

The present institutional design of the Indian system for national-security screening is fragmented. The DPIIT acts as the nodal agency for FDI policy and PN3-related decisions. The Ministry of Home Affairs conducts the security clearances, whereas line ministries are responsible for the sector-specific guidelines. There is no independent screening authority like CFIUS or a specialized statutory body for foreign investment screening. The empirical literature and legal doctrine recognize that the absence of procedural clarity through a codified timeline and clear grounds for denial and appeal mechanisms results in legal uncertainty.20 This could have adverse effects on certain cross-border mergers and acquisitions in technology-dependent sectors where the distinction between national security and commercial strategic interest may not be clearly delineated.

16 Foreign Exchange Management Act, supra note 2.

17 Foreign Exchange Management (Non-Debt Instruments) Rules, supra note 13.

18 Companies Act, supra note 3.

19 Securities and Exchange Board of India (SEBI) Regulations (as applicable).

20 Org. for Econ. Co-operation & Dev. (OECD), FDI Screening in Times of Crisis (2020).

4. Impact on Cross-Border M&A Transactions

4.1 Timing and costs of transactions

The process of introducing a national-security-based screening process into the M&A process has a direct effect on the timeline and cost of the transaction. Many cross-border inbound M&A deals require the approval or security clearance process, which may add one or more levels of administrative oversight without prescribed time limits. Market commentary suggests that sensitive or border country linked transactions can experience delays of several months, during which the transaction is subject to reputational and financing risk. Moreover, the uncertain decision-making process associated with the screening process leads to “over-engineering” in the deal structure.

For example, the deal participants may restrict the foreign investment ratio of shares, exclude the right to govern the company, or undertake investments through third countries to minimize the possibility of refusal due to security considerations.

4.2 Sectors and Investor-Class Impact

There is a difference in the impact of security screening on different sectors. The most attention is paid to telecommunications, defense, vital information infrastructure, and certain strategically important sectors. In such sectors, investors from adjacent countries encounter more difficulties even if the transaction will be beneficial for the Indian target company and the national economy as a whole. Nonetheless, foreign direct investments in non-sensitive sectors conducted by investors from non-bordering countries are automatically approved provided that the transactions do not violate FDI policies and FEMA requirements. Such an approach creates a two-level FDI system whereby “risky investors” need to comply with certain conditions while “low-risk investors” have greater freedom.

4.3 Strategic‐acquisitions and technological‐dependency

National security screening in foreign acquisitions is related to issues of technological dependency and strategic asset control. With India’s efforts toward building self-reliance in emerging technology fields like semiconductors, supercomputers, and telecommunications, the

authorities are careful regarding acquisitions from foreign entities that might result in placing these assets under foreign control.21 On the other hand, some experts opine that heavy national security screenings might make India less accessible to foreign capital and technology investments, especially in deep-tech areas and start-up ecosystems where foreign investment plays a significant role in their success. Recent modifications to the FDI policy regarding beneficial ownership and sectoral clearance are indicative of such efforts toward maintaining the balance.

5. Comparative Perspectives: India, US, and EU

5.1 United States: CFIUS and explicit-statutory-framework

In the USA, the Committee on Foreign Investment in the United States (CFIUS), established under the Defense Production Act and the Foreign Investment Risk Review Modernization Act (FIRRMA)22, provides for reviewing, conditioning or blocking foreign investments that “could” pose a threat to national security.23 The review mechanism requires specific “notices” from the parties concerned to trigger the process and follows statutory time-frames and procedures. In India, the system is not provided under such an elaborate statutory framework but rather involves approval under PN3 and sectoral security clearances as purely a policy-oriented and executive-driven process with limited judicial-review-friendly safeguards.

5.2 European Union: FDI-screening-Regulation-2019/452

Under the EU-wide FDI-screening-Regulation 2019/452, there is a regulatory harmonisation mechanism whereby the member-states must cooperate and exchange information regarding investments that may impact their security or public order24. Member states have discretion to make decisions on FDI but the regulation ensures that at least a common discourse is maintained along with minimum procedural safeguards. In contrast, India maintains a national-level regime and lacks any equivalent legal-

21 Ministry of Electronics & IT, Gov’t of India, Policy on Electronics & IT (various reports).

22 FIRRMA, supra note 5.

23 50 U.S.C. § 4565.

24 Regulation (EU) 2019/452, supra note 4.

harmonisation mechanism or information-sharing network with other countries. This might put foreign investors from India, who engage in cross-border mergers and acquisitions involving regulated targets, in a somewhat less favorable procedural position.

5.3 Convergence and divergence

Both India, the US, and the EU have in common their concern about possible national security implications associated with foreign takeovers in strategically sensitive areas. Moreover, all three regimes feature sector-specific thresholds and enhanced review concerning certain technologies and critical infrastructure.25 The major difference in this case is in institutional design and legal formalization. While the regimes in the US and EU rely primarily on statutory provisions and clear timelines, notice mechanisms, and appeal procedures, the one in India relies almost exclusively on executive policy notices and internal decision-making by the government bodies.

6. Doctrinal and Policy Challenges

6.1 Over-breadth and “blanket” invocation of national security

A recurring criticism in Indian and international scholarship is that “national security” can be

invoked as a catch-all rationale shielding opaque decision-making.26 In the absence of a codified list of criteria such as the nature of the technology, the level of control, or the impact on critical infrastructure there is a risk that security screening may be applied in a non-proportionate or non-transparent manner. This raises concerns under the principle of proportionality and the rule of law, which require that restrictions on foreign investment be targeted, necessary, and least-restrictive.

6.2 Procedural fairness and investor safeguards

India’s current regime offers limited procedural safeguards to investors whose deals are blocked or delayed on national security grounds. There is no statutory requirement to provide written reasons, to allow the parties to present a rebuttal, or to set maximum review timelines. This contrasts with the US and EU models, where parties can engage in a structured dialogue

25 Cf. FIRRMA, supra note 5, with Regulation (EU) 2019/452, supra note 4.

26 OECD, supra note 11.

with the reviewing body and, in some cases, appeal or seek review.2728 Without such safeguards, investors may hesitate to commit to high value cross-border M&A in India, even where the transaction is economically benign and strategically beneficial.

6.3 Overlap with competition and sector-specific regulation

Further, there is a conflict of laws arising from the fact that a deal approved under the Competition Act, 200229, as well as other laws related to specific sectors, may still be subject to national security screening. This would constitute an abuse of regulatory arbitrage and lead to ambiguity in case the standards applied differ. In recent years, researchers have pointed out that India’s policy on cross-border mergers and acquisitions reveals a “disparity” between liberalized corporate law regimes and stricter security-related foreign direct investment policies, thereby causing conflicts. Harmonization of these regimes through some kind of explicit coordination mechanism or common standards at least in inter-agency decision-making processes will enhance legal coherence.

7. Reform Proposals

7.1 Implement a separate National Security Investment Review Act

India may also think about implementing legislation on security investment review, somewhat like the American CFIUS law or the EU’s FDI Screening Regulation.3031 This could involve: Setting up a National Security Investment Review Authority (NSIRA), which would be a multiministerial agency with a statutory mandate to define “critical sectors” and “sensitive technologies.” Creating objective screening criteria, for example in terms of control structure, type of technology involved, sensitivity of data, and possible effects on critical infrastructure rather

27 50 U.S.C. § 4565.

28 Regulation (EU) 2019/452, supra note 4.

29 Competition Act, supra note 7.

30 Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA), Pub. L. No. 115–232, 132 Stat.

2173.

31 Regulation (EU) 2019/452, 2019 O.J. (L 79I) 1.

than simply using “national security.” Implementing a statutory timeline for review (e.g., 30-60 days for normal cases with extensions only available for “high risk” deals)32.

7.2 Implement a risk-based screening process

Instead of adopting PN3-like blanket scrutiny33 in respect of all investments from border countries, India should implement a risk-based screening system. Elements might include: Threshold-based triage: Distinguish transactions based on: • Equity stake (e. g. , minority versus control); • Sector (e. g. , non-sensitive versus critical infrastructure); and • Investor type (e. g. , financial investor versus strategic-industrial-investor). Automatic-route for low-risk transactions: Provide for automatic-route handling for minoritystakes in non-sensitive sectors, even when investors originate from border-sharing countries, provided mandatory-disclosures are made to the NSIRA-type agency.

Enhanced scrutiny for high-risk transactions: Limit mandatory-government-approval and security-clearances to cases involving control-stakes, critical-sectors, or investments related to dual-use/telecommunication/internet/data-intensive-assets. This will help mitigate the “per se” presumption against border-country-investors while ensuring the ability to act where necessary. 34

7.3 Enhance procedural-fairness and transparency

To improve legal certainty and investor confidence, it is crucial that the regime include explicit procedural-protections: Written reasons: The screening-authority should be required to provide clear written reasons

32 50 U.S.C. § 4565 (CFIUS procedure & timelines)

33 Press Note 3 (2020 Series), DPIIT, Govt. of India (Apr. 17, 2020)

34 Org. for Econ. Co-operation & Dev. (OECD), FDI Screening in Times of Crisis (2020)

for any rejection, material-conditioning, or undue-delay, in accordance with administrativelaw principles of reasoned-decision-making. Opportunity for representations: Parties should be permitted to present rebutting-evidence or offer mitigation-solutions (e.g., ring-fencing, data-localization, or third-party-trustees) prior to a final decision. Procedure-based mechanism: Offer either internal review channels or limited judicial review on the grounds of violations in timeliness or non-disclosure of criteria in the evaluation process, without placing any “core security” judgments open to full substantive review. These checks will move India closer towards implementing the CFIUS model of “structured dialogue” along with EU models of transparency standards, even taking into account derogations under national security considerations.35

7.4 Streamlining and single window-type coordination

India’s multi-agency framework, comprising DPIIT, MHA, sectoral ministries, and RBI, is beset with coordination gaps36. The reforms need to focus on: Coordination protocol: Develop an inter-ministerial framework within the proposed NSIRA for synchronization between security clearances, sectoral clearances, and FEMA requirements, all of which are to be integrated on a centralized digital platform.37 Use of current frameworks: Utilize existing platforms such as FIFP and NSWS for screening investments, where applications can be automatically routed to the relevant ministries. Capacity building: Improve capacity building efforts at DPIIT and MHA to deal with security assessments related to technology. More clarity and better coordination can mitigate agency overlap and serve India’s strategic objective of attracting FDI while beefing up its security regulations.

35 50 U.S.C. § 4565

36 Consolidated FDI Policy, DPIIT (as amended)

37 Foreign Exchange Management Act, No. 42 of 1999 (India)

7.5 Balancing PN3-style regulations and categorizing investors

The trends in recent regulatory changes, including gradual reduction of PN3 scrutiny as well as discussions around extending automatic route FDI to certain border countries below the minority stake level, point towards pragmatism. This should be made into official policy by: Setting out “border-country” treatment clearly: Rules must be enacted defining what constitutes a chain of beneficial ownership in such a way that investments via third jurisdictions are not automatically classified as “linked” to border countries when they are not. Creating standards for “trusted investors” or “white-listing”: Where an investor country has strong data-protection laws and enforcement capabilities as well as intelligence cooperation with India, consider a lower standard of screening for certain investment deals.

Review of screening policy: Statutory periodic review (say, every 3 to 5 years) of the list of critical sectors and screening thresholds so as to ensure that regulations stay updated with changing technology and evolving threat landscape. With such steps, India can move from being a PN3-driven approach to having a long-term national security investment policy.

7.6 Harmonise with competition-law and sectoral-regulation

To prevent regulatory arbitrage and conflicting signals, the Indian government must ensure that its security-screening regime is compatible with the Competition Act, 2002 and various industry regulations: Integrated review approach: Wherever possible, align the review process of both CCI review and security screening to make sure that parties receive a unified decision bundle and not deal with fragmented timelines. Joint guidelines on criteria: Develop joint guidelines on the different spheres of competition issues and security issues with DPIIT/MHA and the CCI to clarify whether a merger involves “security” issues or “market structure” issues. Sectoral codes: Develop sector-specific screening codes for telecommunications, defense, energy, and other vital industries with a focus on data sovereignty, supply chain resilience, and

technological dependencies metrics. This would help mitigate the “disparity” between liberal corporate law regimes and securitylinked FDI rules, an issue that academics had already noted as causing conflicts with foreign mergers policy. To prevent regulatory arbitrage and conflicting signals, the Indian government must ensure that its security-screening regime is compatible with the Competition Act, 2002 and various industry regulations: Integrated review approach: Wherever possible, align the review process of both CCI review and security screening to make sure that parties receive a unified decision bundle and not deal with fragmented timelines. Joint guidelines on criteria: Develop joint guidelines on the different spheres of competition issues and security issues with DPIIT/MHA and the CCI to clarify whether a merger involves “security” issues or “market structure” issues.

Sectoral codes: Develop sector-specific screening codes for telecommunications, defense, energy, and other vital industries with a focus on data sovereignty, supply chain resilience, and technological dependencies metrics. This would help mitigate the “disparity” between liberal corporate law regimes and securitylinked FDI rules, an issue that academics had already noted as causing conflicts with foreign mergers policy.

8. Conclusion

To conclude, the national security screening regime for cross-border M&A in India constitutes a justified recalibration of the country’s FDI framework in response to changing geopolitical and technological challenges. Nevertheless, the current dependence on policy notices, discretionary executive powers, and institutional fragmentation is problematic in that regard. India may benefit from implementing a National Security Investment Review Act, using a graded risk-based approach, improving procedural fairness, creating an integrated institutional

architecture, redressing PN3-like rules38, and coordinating with competition and sectoral regulations in order to develop a predictable, proportionate, and flexible screening regime. This will better position the country to align with FDI screening trends globally without compromising its sovereignty.39

38 Press Note 3 (2020 Series)

39 OECD, FDI Screening in Times of Crisis (2020)