Step‑by‑step Guide to M&A Approvals in the United Kingdom, Merger Control, FDI and Sectoral Clearances (2026 Update)

Last updated: 20 June 2026

Any buyer, seller or private‑equity sponsor contemplating an acquisition in the United Kingdom must navigate a layered M&A approval process that can involve competition clearance from the Competition and Markets Authority (CMA), a national‑security review under the National Security and Investment Act 2021 (NSI Act), and one or more sectoral regulator approvals, for example from the FCA, PRA, Ofcom or Ofgem. Getting the sequencing wrong, or starting too late, is the single most common reason deals stall or collapse. This guide sets out each regulatory clearance in the United Kingdom step by step: who files, what documents are needed, how long each stage takes in the current 2026 environment, what it costs, and where the most frequent pitfalls lie.

Overview of the M&A Approval Process and Who It Applies To

The M&A approval process in the United Kingdom applies to share acquisitions, asset purchases and, in public‑company contexts, takeover offers governed by the Takeover Code. It covers transactions involving a UK‑incorporated target, a target with UK revenues or assets, or, under the NSI Act, any entity that carries on activities within one of 17 designated sectors, regardless of where it is incorporated.

Three principal regulators may need to grant clearance before, or, in certain circumstances, after, completion:

• Competition and Markets Authority (CMA). The CMA has jurisdiction under the Enterprise Act 2002 to review mergers that meet the turnover test or the share‑of‑supply test. UK merger control is voluntary: there is no obligation to notify. However, the CMA can, and regularly does, call in completed transactions for investigation, including the power to unwind them.
• Secretary of State (NSI Act). Acquisitions of qualifying entities or assets in specified sectors must be notified to the Investment Security Unit before completion. Mandatory notification is required where the target operates in one of the 17 on‑list sectors set out in the National Security and Investment Act 2021. The Secretary of State may also “call in” non‑notifiable transactions that raise national‑security concerns.
• Sectoral regulators. Change‑of‑control approvals are required under section 178 of the Financial Services and Markets Act 2000 (FSMA) when acquiring control of an FCA‑ or PRA‑authorised firm. Parallel regimes exist for communications (Ofcom), energy (Ofgem), rail (ORR), aviation (CAA) and water (Ofwat). These approvals run concurrently with, but independently of, CMA and NSI processes.

Public M&A bids are additionally subject to the City Code on Takeovers and Mergers, administered by the Takeover Panel. This guide focuses on the regulatory clearances common to both public and private transactions; Takeover Panel procedural rules are outside its scope.

Eligibility and Prerequisites, Merger Control Requirements

Before engaging regulators, deal teams must screen the transaction for each regime and assemble a pre‑notification checklist. In the current 2026 environment, industry observers expect this screening phase to take longer than in prior years because of expanded CMA interest and more frequent NSI call‑ins. Starting the exercise at least 8–12 weeks before anticipated signing is strongly recommended.

How to screen for CMA jurisdiction

The CMA’s jurisdiction under the Enterprise Act 2002 is triggered when either of two tests is met:

• Turnover test: the target’s UK turnover exceeds £70 million.
• Share‑of‑supply test: the merged entity will supply or acquire at least 25 % of goods or services of a particular description in the UK (or a substantial part of it), and the transaction results in an increment to that share.

Because merger control is voluntary, parties sometimes choose not to notify, but the CMA retains the power to investigate completed mergers and, if necessary, require divestiture. Where a transaction is close to the thresholds, or where overlapping activities exist, a formal or informal pre‑notification discussion with the CMA’s mergers team is advisable.

Screening for NSI Act / national‑security risk

The National Security and Investment Act 2021 requires mandatory notification for acquisitions of entities that carry on activities in any of 17 designated sectors, including artificial intelligence, data infrastructure, defence, energy, transport and communications. Transactions completed without mandatory notification are void. The Act also gives the Secretary of State a broad “call‑in” power over non‑notifiable deals that may raise national‑security concerns, with a retrospective reach of up to five years (or six months from the date the government becomes aware of the transaction).

Red flags that should prompt a deeper FDI/national security review include: target involvement with government contracts, access to sensitive personal data, proximity to defence or critical national infrastructure sites, and acquirer connections to states of concern.

Sectoral regulator triggers

Where the target holds regulatory licences or permissions, sectoral regulator approvals will be required. The most common scenario is the acquisition of control over an FCA‑ or PRA‑authorised firm, which triggers a mandatory change‑of‑control application under FSMA s.178. Similar obligations arise under the Communications Act 2003 (Ofcom), the Electricity Act 1989 and Gas Act 1986 (Ofgem), and sector‑specific legislation for rail, aviation and water.

Practical tip: map every regulatory licence held by the target early in due diligence and confirm whether the proposed change in ownership crosses any consent threshold (commonly 10 %, 20 %, 30 % or 50 % of voting rights for financial services firms).

Step‑by‑Step Procedure for the M&A Approval Process in the United Kingdom

The following numbered steps describe the procedural sequence from initial screening to post‑clearance compliance. The mandatory timeline table below summarises each step, who is responsible, and the typical duration in 2026.

Step 1, Pre‑deal screening and internal decision to notify

The buyer’s legal and strategy team assesses whether the transaction meets the CMA’s turnover or share‑of‑supply thresholds, touches on any NSI Act on‑list sector, or requires sectoral regulator consent. The output is an internal regulatory‑risk matrix that determines which filings are needed, whether notification is mandatory or voluntary, and the optimal sequencing relative to signing and completion. This step typically takes 1–2 weeks and should begin at the term‑sheet or letter‑of‑intent stage.

Step 2, Pre‑notification stakeholder engagement and bundle preparation

Buyer counsel and economic advisers prepare the notification bundle, the documents needed for the merger filing and any parallel NSI or sectoral submissions. This includes competitor analysis, market‑share data, customer lists, ownership charts and the transaction summary. Where a CMA filing is contemplated, an informal pre‑notification discussion (sometimes called a “briefing paper” submission) helps identify the CMA’s likely theories of harm early. For NSI notifications, the mandatory notification form must be completed with transaction details, beneficial‑owner information and on‑list activity evidence. Allow 2–4 weeks.

Step 3, File CMA Phase 1 merger notice and/or NSI notification

The buyer’s legal team files the merger notice with the CMA (if a voluntary notification is made) and, where required, the mandatory or voluntary NSI notification with the Investment Security Unit. The CMA’s Phase 1 review period is 40 working days from the date the CMA confirms it has sufficient information to begin its assessment. The NSI Act initial assessment period is typically around 30 working days from acceptance of the notification. Both filings can be made concurrently, and in PE‑backed deals it is common to file at or immediately after signing, with completion conditional on clearance.

Step 4, CMA Phase 1 outcome: clear, accept undertakings or refer

At the end of Phase 1, the CMA decides whether to clear the merger unconditionally, accept undertakings in lieu of a reference (UILs) that resolve identified concerns, or refer the case to Phase 2 for an in‑depth investigation. If the CMA identifies a “realistic prospect” that the merger may result in a substantial lessening of competition (SLC), and the parties cannot offer satisfactory UILs, a Phase 2 referral follows. During this period, the CMA may impose interim measures, such as an initial enforcement order, to prevent pre‑emptive action by the parties.

Step 5, CMA Phase 2 in‑depth investigation and/or NSI full assessment

A Phase 2 investigation is conducted by an independent inquiry group of CMA panel members. The statutory timetable is up to 24 weeks, which may be extended by up to eight weeks in complex cases. The Phase 2 process involves detailed information requests, third‑party questionnaires, hearings and, if an SLC is found, consideration of remedies (which may include prohibition or divestiture). Separately, where the Secretary of State issues a “call‑in notice” under the NSI Act, a full national‑security assessment follows, during which the government may impose interim orders and ultimately approve, approve with conditions, or block the transaction.

Step 6, Sectoral regulator change‑of‑control approvals

If the target is authorised by the FCA or PRA, a change‑of‑control application under FSMA s.178 must be submitted. The statutory assessment period for a standard application is 60 business days, although the regulator may “stop the clock” to request additional information. Sectoral regulator approvals should be filed as early as possible and run concurrently with CMA and NSI processes to avoid extending the overall deal timetable. Other sectoral regulators (Ofcom, Ofgem, ORR, CAA) have their own approval timelines, which vary by sector and transaction type.

Step 7, Remedies negotiation and documentation

Where the CMA identifies an SLC, or the Secretary of State identifies national‑security risks, remedies may be required as a condition of clearance. CMA remedies can range from behavioural undertakings to structural divestiture. NSI Act remedies may include restrictions on access to sensitive sites, information‑sharing protocols or, in extreme cases, prohibition. The parties negotiate the scope and wording of remedies directly with the relevant authority. Timing ranges from a few weeks (for straightforward UILs) to several months (for complex structural remedies at Phase 2).

Step 8, Clearance and post‑clearance compliance

Once all regulatory clearances are obtained and any conditions or undertakings are agreed, the transaction may complete. Post‑clearance obligations include: registering any remedy conditions with the CMA or Secretary of State, complying with ongoing monitoring requirements, notifying sectoral regulators of the completed change of control, and filing updated ownership information with Companies House. Interim enforcement orders remain in force until formally revoked. Failure to comply with post‑clearance conditions can result in financial penalties and, in the case of NSI Act breaches, criminal sanctions.

Required Documents and Information for UK Regulatory Clearances

Preparing the right documents early is critical to avoiding delays. The table below lists the core documents needed for merger filing with the CMA, NSI notifications, sectoral regulator applications and lender approvals. Format and depth will vary by transaction, but every deal team should treat this as a baseline pre‑notification checklist.

For PE‑backed transactions, the documents needed for the merger filing should also include fund structure charts showing limited‑partner interests, co‑investment arrangements and any existing portfolio overlaps. Lender documentation, intercreditor agreements, completion‑mechanics letters and condition‑precedent checklists, must be aligned with regulatory timetables so that financing drawdowns are not frustrated by outstanding approvals.

Sector‑specific documents will be required for FCA/PRA change‑of‑control applications, including the applicant’s programme of operations, a business plan for the authorised firm post‑acquisition, and personal details (including fitness and propriety information) for proposed controllers. Similar bespoke requirements apply to Ofcom, Ofgem and other sectoral regulator approvals.

Timeline and Key Deadlines for the M&A Approval Process in the United Kingdom

The overall timeline depends on which approvals are required and whether any are referred to an in‑depth review stage. The following examples illustrate a realistic 2026 timeline, incorporating the longer assessment periods now being observed.

Example A, Simple share purchase, no NSI or sectoral triggers: Begin CMA screening at the letter‑of‑intent stage. Prepare the notification bundle over 3–4 weeks. File the CMA merger notice at or shortly after signing. Expect a Phase 1 decision within 40 working days. Total timeline from LOI to clearance: approximately 10–13 weeks. In the current 2026 environment, adding a 2–3 week buffer is prudent.

Example B, PE‑backed acquisition with NSI risk and FCA‑regulated target: Begin screening during the exclusivity period, at least 8–12 weeks before signing. File NSI mandatory notification and CMA merger notice at signing. Submit the FCA/PRA change‑of‑control application concurrently. Expect the CMA Phase 1 timetable of 40 working days to run in parallel with the NSI initial assessment (~30 working days) and the FCA/PRA 60‑business‑day assessment period. If no Phase 2 referral or NSI call‑in occurs, completion may follow 3–4 months after signing. If Phase 2 or a full NSI assessment is triggered, allow 6–9 months or more.

Early indications suggest that CMA Phase 2 investigations are increasingly running closer to the full 24‑week statutory maximum, and extensions are being used more frequently. Deal teams should plan for the upper end of published timetables rather than historical averages. Lender commitments, break‑fee structures and long‑stop dates in transaction documents should all reflect these longer windows.

Key statutory deadlines to diarise:

• CMA Phase 1: 40 working days from the date the CMA confirms sufficient information.
• CMA Phase 2: up to 24 weeks from the date of referral (extendable by up to 8 weeks).
• NSI Act initial assessment: ~30 working days from acceptance of the notification.
• NSI Act call‑in: the Secretary of State has up to 6 months from becoming aware of a qualifying transaction (or 5 years from completion) to issue a call‑in notice.
• FSMA s.178 change‑of‑control: 60 business days (may be paused for information requests).

Costs, Fees and Tax Considerations

The CMA does not charge a standard filing fee for merger notices, which distinguishes UK merger control from many other jurisdictions. Costs are driven primarily by adviser fees, economic and legal, and by sectoral regulator application charges. The table below provides indicative ranges.

Buyers should also budget for the cost of implementing remedies (if imposed), post‑clearance compliance monitoring, and any break‑fee exposure if clearance is not obtained within the long‑stop date. VAT is chargeable on professional fees at the standard rate.

What Changes in the CMA Timeline and UK Regulatory Clearances in 2026

Several practical developments affect the M&A approval process in the United Kingdom in 2026. Industry observers expect these trends to persist through the year and into 2027:

• Longer Phase 2 investigations. The CMA has signalled a more interventionist posture. Analysis published by White & Case notes that the CMA’s revised approach to UK merger control has increased scrutiny of digital, technology and healthcare transactions, with Phase 2 reviews more frequently running to the statutory maximum of 24 weeks or being extended.
• More frequent NSI call‑ins. The volume of call‑in notices issued under the NSI Act has risen since the Act came into force. Government guidance emphasises that voluntary notification is encouraged even where not mandatory, and early indications suggest that the Investment Security Unit is scrutinising PE‑backed transactions with closer attention to beneficial‑ownership structures.
• Tighter interim enforcement. The CMA is making greater use of initial enforcement orders to prevent integration pending investigation. Breach of an interim order can result in significant fines.
• Sectoral convergence. The FCA and PRA are coordinating more closely with the CMA on transactions involving financial‑services firms, which can extend combined review timelines.

2026 action checklist:

• Start screening and pre‑notification workstreams at the exclusivity or term‑sheet stage, at least 8–12 weeks before signing.
• Build 25–50 % time buffers into long‑stop dates and financing commitments.
• Prepare pre‑emptive remedy proposals where overlaps or national‑security concerns are foreseeable.
• Involve lenders early so that condition‑precedent mechanics align with regulatory timetables.
• Run dynamic market screens (not static snapshots) to anticipate CMA theories of harm.

Common Pitfalls in the M&A Approval Process and How to Avoid Them

• Late regulatory screening. Failing to assess CMA, NSI and sectoral triggers until after signing compresses timetables and creates completion risk. Mitigation: screen at LOI or exclusivity stage.
• Underestimating NSI Act scope. Acquirers sometimes assume the NSI Act applies only to defence or government contractors. The 17 on‑list sectors are broad and include data infrastructure, AI, energy and transport. Mitigation: conduct a sector‑mapping exercise for every UK target.
• Incomplete market‑share evidence. Submitting a CMA merger notice without robust market data leads to information requests and clock stops. Mitigation: commission economic analysis and prepare data‑room exhibits before filing.
• Ignoring lender coordination. Financing documents that do not align with regulatory timetables, for example, commitment expiry dates that fall before a realistic clearance window, can force renegotiation or deal collapse. Mitigation: share realistic timeline assumptions with lenders at the outset.
• Failing to seek confidentiality protections. Commercially sensitive data submitted to the CMA or NSI Unit may be disclosed to third parties during consultation unless confidentiality undertakings are in place. Mitigation: request confidentiality rings and redact appropriately.
• Not planning for interim remedies. The CMA can impose initial enforcement orders from the moment a reference decision is taken. Parties who integrate before clearance risk being required to reverse structural changes. Mitigation: maintain separation of target operations and ring‑fence commercially sensitive information pending clearance.
• Misaligned long‑stop dates. Transaction documents with tight long‑stop dates leave no room for Phase 2 referral or extended NSI assessment. Mitigation: negotiate long‑stop dates that accommodate upper‑end statutory timetables plus a buffer.
• Omitting post‑clearance compliance. Parties sometimes treat clearance as the end of the regulatory process. Ongoing obligations, monitoring, reporting and condition compliance, remain enforceable. Mitigation: appoint a compliance lead and calendar all post‑clearance deadlines.

Sources

1. GOV.UK, Mergers: when they will be investigated (CMA)
2. Competition and Markets Authority (CMA), guidance and merger remedies
3. National Security and Investment Act 2021, legislation.gov.uk
4. Enterprise Act 2002, legislation.gov.uk
5. Financial Services and Markets Act 2000, s.178, legislation.gov.uk
6. White & Case, The CMA’s revised approach to UK merger control
7. Dechert, United Kingdom M&A Legal Guide
8. Baker McKenzie, Global Private M&A Resource Hub (United Kingdom)
9. Mayer Brown, FAQs: UK Regulatory Approvals for Insurance M&A
10. ICLG, M&A Laws and Regulations United Kingdom (2026)
11. GOV.UK, National Security and Investment Act 2021 (collection)