Foreign Direct Investment Security Review: A Methodological Handbook for Assessing the EU Regulatory Environment

Introduction: Why Understanding FDI Security Review Matters

Foreign Direct Investment (FDI) is a key driver of global economic integration. For multinational enterprises, entering new markets not only expands their customer base, but also enables them to acquire strategic assets, technology, and management expertise. However, in recent years, many countries have established or strengthened security review mechanisms targeting FDI on grounds of national security or public order. In 2019, the EU issued Regulation (EU) 2019/452, creating for the first time a Union-wide cooperation framework for FDI screening, while member states were encouraged to maintain or establish their own national review regimes.

Against this backdrop, investment environment assessment must include a critical dimension—the regulatory review of foreign investment. Overlooking this dimension may cause enterprises to encounter non-commercial obstacles late in a transaction, such as prohibitions, restrictive conditions, or even substantial fines. Drawing on the research methods of international institutions and using the EU as an example, this handbook explains the institutional logic, operational framework, and investor response strategies of FDI security review. Whether you are a corporate strategy officer, an international business executive, or an investment promotion professional, understanding this regulatory assessment approach will help you make more robust cross-border investment decisions.

It should be noted that this handbook is intended solely as an informational reference and does not constitute legal advice in any jurisdiction.

Section 1: Understanding the Basics—The Evolution of FDI Security Review and Core Terminology

FDI: From Development to Security

The definition of foreign direct investment typically draws on IMF and OECD standards: investment made by a resident entity in one economy into another economy (the host country) for the purpose of establishing a "long-term relationship" and "lasting interest." FDI generally includes establishing subsidiaries or affiliated enterprises, acquiring a significant equity stake (usually above 10%), and having the ability to influence management decisions.

Traditionally, FDI review focused on competition law and monopoly control. However, since the 2010s, technological development, geopolitical competition, and supply chain security have led to the rapid rise of national security review. UNCTAD's World Investment Report has tracked the increasing adoption of investment screening mechanisms by countries worldwide, with review scope expanding from defense to critical infrastructure, advanced technology, data security, media, public health, and other areas.

The EU FDI Screening Mechanism (Regulation (EU) 2019/452)

The Regulation became fully applicable in October 2020. It does not replace member states' existing domestic review mechanisms, but rather provides a framework for cooperation and information exchange. According to the Regulation:- Member States are responsible: Each EU country may maintain or separately establish a national FDI screening mechanism. For example, Spain has a security screening regime for foreign investment (after temporary measures such as the suspension of golden visas in 2020, it has become a regular regime). Once a transaction is deemed likely to affect security or public order, the Member State government is entitled to review it directly, attach conditions, or prohibit it.

• Role of the European Commission: Although the final decision-making power lies with Member States, the European Commission may issue opinions on specific transactions (involving security or public order) and is entitled to request information from Member States. For projects of EU relevance (such as European strategic funds, the Galileo programme, etc.), the Commission may issue opinions to Member States, which must take them into account.
• Cooperation mechanism — multilateral information sharing: Member States must notify one another of ongoing reviews, exchange information, and take into account the views of other Member States. In other words, a transaction in which a Chinese investor plans to acquire a Spanish technology company would not only be reviewed by the Spanish government; other EU countries may also raise concerns.

In the referenced news, the European Commission stated that "Spain is responsible for screening the security risks of Chinese investment." This wording reflects the basic principles above: even under the unified EU framework, the authority to assess the security of a specific transaction remains with the host country, while the European Commission is mainly responsible for coordination and supplementation.

Key Terms: Security Screening, Public Order, Suspension Period

Security screening: A mandatory or voluntary filing and review procedure, led by the host government, for specific foreign investment projects. Public order: In the investment context, it generally refers to matters involving fundamental social interests, defense capabilities, the operation of critical infrastructure, technological sovereignty, and even public health (e.g., during an epidemic). Suspension period: In many countries, the review procedure freezes the transaction during the review period; investors must wait until approval is completed before closing. Mitigation conditions: Such as requiring the divestment of specific assets, excluding sensitive markets, designating personnel, periodic reporting, etc.

Section 2: Key Framework — How to Analyze a Host Country's FDI Regulatory Environment

Based on the analytical logic repeatedly used by the OECD and UNCTAD, we can establish a unified analytical framework that assesses a host country's foreign investment security review environment along five dimensions (applicable to EU Member States, and also extendable to other economies):

Macro-Institutional Level (Regulatory Foundation)

• Is there a statutory law establishing a foreign investment security review mechanism?
• Which department enforces the review law? Is there a distinction between general foreign investment law and special national security regulations?
• Is the review procedure transparent? Are public guidelines and precedents published?

Triggers- Is the trigger automatic based on transaction attributes (e.g., industry, shareholding ratio, transaction amount)?

• Does it cover all foreign investors, or only investors from particular countries or state-owned entities?
• Is there a non-mandatory, voluntary filing mechanism? Can low-risk projects apply for an exemption in exchange for certainty?

Actors and Procedure

• Which government bodies (e.g., investment review committee, ministry of economy, ministry of defense) have the authority to initiate and decide?
• What are the timelines and statutory review deadlines? Does failure to respond within the deadline amount to tacit approval?
• Is there an inter-agency coordination mechanism? Are EU member states required to notify the European Commission/other member states?

Substantive Standard

• How does the law interpret “national security” and “public order”?
• Are origin-country factors considered (e.g., whether the country is a WTO member, whether reciprocal restrictions exist)?
• Is a multi-factor weighting introduced (e.g., sensitivity of critical infrastructure, technology, defense, media)?

Remedies

• Can investors request written reasons?
• Can they raise objections at different administrative levels or through the judicial system?
• Is there a procedure for re-applying or modifying the transaction plan?

Under the EU framework, member states’ governments enjoy broad substantive discretion. Therefore, the above dimensions must be populated with specific host-country domestic legal information before a reliable assessment can be given.

Section III: Practical Process — A Step-by-Step Investment Environment Screening Approach

When a multinational company is considering an investment in an EU country, it may follow the following five steps. Each step can operate independently and also serves the overall risk assessment and investment decision.

Step 1: Clarify Investment Objectives and Sensitivity Classification

First, clarify whether this FDI is a greenfield investment, an acquisition, or a joint venture, and whether it is technology-oriented or market-oriented. Does the activity fall within a “sensitive sector”? The European Commission’s list of concern sectors may be used—energy, transport, communications, data, artificial intelligence, robotics, semiconductors, and dual-use items, among others. At the same time, consider whether government subsidies or a state-owned background are involved. This step completes the internal self-assessment and produces a transaction card.

Step 2: Mapping — Identify Relevant Jurisdictions and Regulatory Regimes

If the investment destination is Spain, the following must be consulted at the same time:

• Spain’s domestic investment review law (currently based mainly on regulations restricting foreign investment, including security approvals for specific sectors and mandatory prior notification obligations).
• EU Regulation No. 452 and related cooperation mechanisms. This is because, when the investor conducts cross-border business in the EU, the countries where its suppliers or customers are located may also express views on this investment, thereby affecting the transaction.

At the same time, investigate whether there are minimum shareholding thresholds, antitrust filing thresholds, and sector-specific licenses (such as finance and telecommunications). These three are independent of one another and are often confused by investors.### Step 3: Assess the Probability of a Specific Transaction Triggering Review

Use the industry attributes, shareholding ratios, and identity of the transacting parties from Step 1 to compare against the regulatory framework in Step 2. Spain has specific screening rules for certain non-EU investments (including China), and sometimes expands definitions on grounds of “public security.” One needs to determine:

• Does the transaction fall under mandatory approval?
• Does it fall within the notification threshold?
• Is there a “voluntary explanation” mechanism to obtain a security opinion in advance?

Most projects carry low risk, but there are “gray areas”—for example, merely obtaining a minority stake may still lead to board representation. It is advisable not to presume in advance.

Step 4: Risk Probability Scoring and Mitigation Design

Estimate the probability that the transaction will pass review, as well as possible attached conditions. Judging from historical cases, Spain, France, Germany, and Italy are very wary of acquisitions by foreign state-owned enterprises in sensitive industries. Based on this, assess whether approval rates can be improved through “active mitigation” (e.g., committing not to access sensitive data, having host-country directors chair technical committees, establishing local trusts, etc.), or whether to adjust the transaction structure (e.g., making a minority equity investment first) to increase certainty.

Step 5: Long-Term Sustainability Review

Foreign investment review is not a “one-off” step. After closing, investors may still face:

• Re-triggering of review upon exit audits or future expansion of the investment business;
• Technology export restrictions (if the acquired enterprise conducts R&D in the EU);
• The host country amending laws or requiring changed conditions after five years. If the investment strategy involves a longer return cycle, the stability of the legal environment and the weight of administrative discretion become very important. The host country’s past attitude toward similar transactions can be used as a basis for prediction.

Section 4: Host Country Assessment Reference Indicators—Core Factors Determining Review Approval Rates

The following set of indicators can help investors compare the intensity of review across different countries or in a particular host country. These indicators are commonly used in the literature and OECD policy reviews and are provided for analysts’ reference.| 指标 | 观察问题 | 为何重要 | | --- | --- | --- | | 法定细化程度 | 法律是否清楚定义受约束的企业类型、行业、交易规模？ | 法律越明确，投资者越容易提前应对，行政随意性较小。 | | 强制申报门槛 | 受约束的行业与最低持股比例门槛为何？ | 门槛过高会降低外资吸引力，过低则增加了企业不必要负担。 | | 来源国对待 | 是否对不同国家实施差异化标准？ | 基于来源国的差别待遇到涉及WTO非歧视原则，但安全审查常常例外，需要特别关注。 | | 行政审查独立性 | 是主导部门决定，还是多机构共同参与，是否存在政治干预？ | 多元与透明的制度会加大可预期性，但同时也可能降低进度速度。 | | 历史审批格局 | 过去三年中，对外资案件否决或附加条件情况占投资申报比例？ | 用实际数据获得客观风险概率。 | | 时长与可预测性 | 是否有法定明确的60-90天时限，可否延期？ | 太长的审查期会影响交易确定性及资金成本。 | | 合规救济空间 | 在否决前是否允许投资者做出陈述和纠正？ | 程序正义是降低非商业风险的重要手段。 |

对欧盟而言，还需要增加一项欧盟层级指标：

• 外国投资者所在国是否与欧盟签署特定贸易投资协定，以及其他成员国的立场。因为其他成员国可能持有顾虑，而欧盟委员会会传递此类意见。

第五节：常见挑战与区域性风险

即使做了充分准备，跨国公司仍会遭遇以下几类经典挑战：

政策不确定性与规则创新

由于技术迭代与地缘政治态势，安全审查制度变动异常频繁。例如，2020年疫情初期，多个欧盟成员国迅速收紧了外资审查；此后尽管紧急状态结束，相应临时规则仍长期化。企业需要定期（如每半年）重新审视法律清单。

成员国和布鲁塞尔相互拉锯

正如新闻所呈现的，欧盟委员会认为权力与责任在成员国（如西班牙），但事实上委员会可以通过发表“意见”影响进程。投资者如果忽略欧盟一层，可能被所谓的“双重关注”所困：西班牙批准了，但其他成员国感到不满，并表达反感，从而在后续交易中报复。

非正式威胁与媒体压力

Security review is not a static set of provisions. Many cases are influenced by public media discussion, union opposition, and pressure from political figures. In acquisitions of strategic technology enterprises, France and Italy often achieve outcomes through "administrative persuasion to withdraw" rather than formal prohibition. Small and medium-sized enterprises are especially vulnerable to unofficial steering pressure.

Post-review compliance burden

Once conditions are attached (e.g., restrictions on technology transfer, appointment of directors approved by government authorities), enterprises need to invest resources in tracking compliance status; otherwise, they face huge administrative fines and judicial investigations. Moreover, long-lasting compliance obligations may significantly dilute the synergy value of an M&A.

Impact of source-country countermeasures

If the investor's home country imposes discriminatory screening on European enterprises or excessively intervenes in the market, the host government is likely to adopt stricter countermeasures against specific investors. For example, while China is subject to EU screening, it may also add "legal obstacles" to EU enterprises' investment in China, creating a cycle. Therefore, pure legal analysis is no longer sufficient to explain screening outcomes; it is also necessary to assess bilateral political and economic relations—a highly uncertain but essential variable in FDI risk.

Section 6: Case demonstration—using the framework to interpret typical situations

This section provides a brief analysis of three public cases to demonstrate how the above framework is applied. The cases do not represent support for or criticism of any particular company; they are merely used to illustrate the mechanism.

Case A: A port infrastructure project in Spain (fictionalized)

An Asian state-owned group planned to acquire partial equity in a major Spanish port (involving a key value chain). Under Spanish law, this type of transfer requires approval by the Council of Ministers when the trigger threshold is met. In addition, the port is located in a special transport zone along the Mediterranean coast outside the collaborative jurisdiction of Schengen, so the project is also subject to EU review regarding transport policy. Applying the framework:

• Macro-institutional level: Spanish law is clearly defined, but multiple ministries are involved, which may result in an approval timeline of 6–18 months;
• Trigger: Industry—port infrastructure, regarded as "critical infrastructure"; Source country—conditional restrictions on state-owned entities under circumstances the EU considers "specific situations";
• Historical approvals: There have been a few conditional approvals in the same region, with no public rejections, but market participants say the government often uses delay tactics to force withdrawal.

Assessment result: The probability of approval is about 60%, and mitigation measures such as opening up supporting industries should be added (for example, inviting Spanish port enterprises to co-operate). This case shows that structural restructuring may be more effective than legal defense.

Case B: Minority equity investment in a German chip equipment enterprise

A European venture capital fund intended to join with a Chinese enterprise to acquire a 10% stake and a technology observer seat in a leading German chip etching equipment enterprise. Under the German Foreign Trade Ordinance, shareholdings of 10% or more by third-country investors are subject to review, and the chip sector is automatically considered sensitive. Within the prescribed period after receiving Germany's notification, the European Commission issued an opinion stating that the technology could potentially be used for military chip production and recommended that Germany attach export restriction conditions. Germany ultimately agreed to the conditional approval.The investor truly experienced dual "soft suppression" from the EU and its member states. Only after repositioning the investment as purely financial in purpose, without technology access rights, could the transaction move forward. The case highlights the importance of early technical due diligence and communication.

Case C: The Wave of Re-review in the Acquisition of a Greek Port Company

Before the EU Regulation, Greece sold a partial stake in a major port to a Chinese shipping company in 2015. Later, as geopolitical circumstances changed, the European Commission and member states considered that the original transaction posed security risks. However, because they could not act retroactively, they only re-assessed it on national security grounds when the concession rights were subsequently extended. Having assumed the project was already "stable," the investor instead faced a second review and was forced to accept restrictions on its operational boundaries.

This case serves as a reminder about post-investment review: security review does not only occur at the time of acquisition; it can also be triggered again during major expansions or renewal of operating rights.

Through the above cases, readers can see that, when facing host-country regulation, they should consciously apply the framework described earlier and conduct tabletop exercises in advance.

Section 7: Practical Checklist

Before making an outbound investment decision, use the table below to check your readiness. This toolkit is not a substitute for legal services; rather, it helps your company build a repeatable internal process.

Pre-investment Stage (Due Diligence Period)

• Mark a list of "sensitive activities" in the industry and technology map (with reference to EU classifications);
• Understand the mandatory filing thresholds under the host country's foreign investment legislation and whether special source-country rules apply;
• Confirm that minority projects that do not require foreign investment approval are still subject to special industry licensing requirements that cannot be bypassed;
• Analyze whether the transaction matches the host government's preference for "greenfield construction" over "M&A"—many European countries welcome greenfield investors and offer fast-track channels; even when M&A deals face review, greenfield projects are less likely to trigger it;
• In cases of regulatory uncertainty, consider submitting an informal request for guidance to the minister's office or the investment agency, and keep a record.

Review and Filing Stage

• Prepare a clear value-chain rationale explaining how the investment will benefit local R&D and employment;
• For European transactions, apply the rules on cooperation with the European Commission to check whether multiple member states need to be notified simultaneously;
• When preparing the information memorandum, set out how trade secrets and personal data will be handled;
• Pre-design a "package of possible commitments"—for example, retaining local cloud servers, not transferring specific technologies to the home country, and exercising veto rights over management members.

Post-approval Stage- [ ] Confirm whether an internal compliance department has been established and whether records of compliance with the attached conditions are reviewed regularly;

• If there is any plan to transfer technology or knowledge to the parent company, ensure that the boundaries of the approval are not violated;
• Preserve all documents of communication with the host country so as to cope with future administrative reviews;
• Every 12 months, re-examine trends in the relationship between the investment source country and the EU, as well as legislative amendment plans, and establish an early warning system.

Universal Dimensions Checklist

• Economic environment: Do market demand and exchange rate stability support this long-term investment?
• Legal system: What is the status of foreign investment screening within the overall investment law system? Is it prone to change?
• Operating environment: Will infrastructure, labor, and supply chains be impaired by regulation?
• Exit mechanism: If screening leads to a prohibition, is there a contingency plan—such as establishing a joint venture instead?

Conclusion: Developing a Systematic Awareness of FDI Screening Risks

Since the adoption of EU Regulation No. 452, investment by Chinese enterprises in the EU is no longer governed only by market logic and competition law. The multi-level governance between the European Commission and the member states has made regulatory review full of unpredictability and coordination costs. Member states such as Spain retain their core powers—as official statements show, the unified opinion from Brussels is still implemented case by case by Madrid in practice.

For investors, what matters most is never to rush in hastily after presupposing legal risks, but instead, before formal approval, to fully understand the characteristics of the institutional layer, trigger layer, procedural layer, and substantive standard layer, and to reduce risks through transparent communication and structural optimization. For investment promotion agencies and researchers, consistent indicators should be used to track each country's regulatory cycle, because security screening has replaced traditional tariffs and quotas and has become a boundary variable in the international investment environment.

It is recommended that multinational enterprises treat FDI compliance review in their investment decision-making process as a dimension as important as market and financial considerations, rather than a matter for which external legal advisers are consulted only at the last minute. Only by embedding it into the company's strategic process can genuine competitiveness be preserved when dynamic risks emerge against a complex global political backdrop.

This manual is written based on publicly available international sources as of 2025. If you need to use the specific transaction review rules of a particular EU member state, be sure to consult professional advisers and review the latest legislation published in that country's official gazette.

Disclaimer: This article is published by GlobalFDI.org. It is an international investment knowledge-sharing publication and does not constitute legal advice. GlobalFDI.org is committed to providing objective, non-commercial, research-based knowledge to serve the global investment community.