The Wire
Private Mode is on. No preferences, library, notes, or reading history are stored, and no jurisdiction is written to the address bar.
Center for International and Comparative Law · Emory University School of Law

The private international law of cross-border deals

Foreign by Control: When the Buyer’s Passport Stops Mattering

The trigger moves from where the buyer is incorporated to who sits at the top of the control chain. The standard for stopping a deal does not move, so what the widening delivers is not more prohibitions. It is a larger class of deals inside a national authorization requirement, on the one clock the Regulation gives no end.

The Lead

The EU’s new foreign-investment screeningA regime that reviews acquisitions for national-security or public-order risk and can block or condition them. regulation, Regulation (EU) 2026/1386, defines the investor it reaches by looking through the buyer to whoever ultimately controls it. It entered into force on July 16, 2026 and applies from January 17, 2028, the date by which every Member State must have established a screening mechanism and notified it to the Commission.1 From that date a deal run through a European holding company will not sit outside the Union regime merely because the acquirer is European on paper: the definition of a foreign investment reaches an investment carried out “through a foreign investor’s subsidiary in the Union,” which the Regulation defines as an undertaking established under the law of a Member State and directly or indirectly controlled by a foreign investor.6

And the word the whole trigger turns on is not defined. Article 2 runs to twenty-two definitions and not one of them is “control,” although at least four turn on it. Point (1) catches an investment enabling effective participation in the management or control of the target; point (5) confines “foreign investor” to a third-country national or an undertaking organized under the law of a third country; point (7) reaches that investor’s subsidiary in the Union where it is directly or indirectly controlled by it; and point (6) defines a beneficial owner by reference to who directly or indirectly owns or controls the investor or the target and on whose behalf control is exercised. Point (6) is the nearest thing to a benchmark the instrument contains, which makes it the first place an argument by analogy will start, and the analogy it invites is to anti-money-laundering practice rather than to merger control. Whether a third-country limited partner in a European fund controls that fund’s bolt-on acquisitions is not a question these definitions answer, and it is the question a fund lawyer will ask first.6

What widens. Screening stops being optional. Under Regulation (EU) 2019/452 Member States “may maintain, amend or adopt” a mechanism; under the new Regulation each “shall establish” one. And the sector floor becomes a Union floor rather than 27 national ones. Article 4(15) requires every Member State to impose a prior authorization requirement where the target develops, produces, or commercializes dual-use or defense-listed items, works on the semiconductor, quantum, or artificial-intelligence technologies listed in the Regulation’s own Annex I, is active in transport, energy, or digital infrastructure and is assessed as critical, handles listed strategic raw materials, is a named financial-market institution, or runs electoral systems.7

And the Regulation runs two clocks. For an investment that was not subject to a prior authorization requirement, the authority’s own-initiative power must last at least 15 months and may, at each Member State’s election, run to five years. For an investment that was subject to authorization and was never filed, or was filed only after completion, the floor is 24 months and the Regulation states no maximum, leaving the far end to the national mechanism each Member State must establish2A period after closing during which an authority can review and unwind a transaction it was never asked to clear..

The look-through is what decides which clock a deal is on. Take the buyer in Xella: a Hungarian company owned up the chain from Bermuda. Today that buyer is outside the scope of the Union regime, and the Court said so, holding that the assessment factor in Article 4(2)(a) of Regulation (EU) 2019/452 relates only to the ownership structure of a “foreign investor” as art. 2(2) defines it and does not extend the Regulation’s scope to a Member-State undertaking under third-country majority control. From January 17, 2028 that buyer is a foreign investor by definition. If the target sits in one of the Article 4(15) sectors, the deal is notifiable. And a deal team working from the map Regulation (EU) 2019/452 drew does not file it. That deal has not merely been added to the clearance map. The look-through makes it notifiable, the missed filing puts it on the Article 4(5) clock, which states no maximum, and the five-year ceiling in Article 4(4) was never available to it in any state of the world. Article 4(4) is confined to an investment not subject to a prior authorization requirement, so the moment the deal becomes notifiable it leaves that article behind, whether or not anyone files. What the diligence step decides is not which ceiling applies. It decides whether there is one.

What does not widen is the standard. The Regulation enlarges the set of transactions that must be reviewed. It does not touch the reason a deal can be blocked, and so it does not enlarge the set that can lawfully be stopped: that set is drawn by the Treaty and not by the trigger. Xella stated the standard six months before the Commission proposed this Regulation: an undertaking incorporated in a Member State is an EU company entitled to freedom of establishment whatever the origin of its shareholders, and grounds of public policy and public security, as derogations from a fundamental freedom, must be construed strictly; as to security of supply in particular, the Court held that such an objective may be relied on only where there is a genuine and sufficiently serious threat to a fundamental interest of society. The constraint is the Treaty, not the Regulation, and a regulation cannot authorize what the Treaty prohibits.

Which Treaty freedom is in issue decides how narrow the margin is, and the Regulation’s own recital 10 names both. Xella is an Article 49 holding: the Court said in terms that the case fell to be examined solely under freedom of establishment, because the acquirer was an EU company, and Article 52(1) excuses a restriction on that freedom only on grounds of public policy, public security, or public health. Where the investor is itself a third-country undertaking, which is the case the new Regulation is written for, the freedom is Article 63 TFEU, the derogation is Article 65(1)(b), and the Court has long held that capital movements to and from third countries take place in a different legal context. The margin in the Regulation’s central case is therefore wider than a reading of Xella alone would suggest.

Two different reviews also have to be kept apart. A challenge to the Regulation itself would be a review of a Union act adopted under Articles 114 and 207(2) TFEU, where the legislature has a wide margin and the question is proportionality to the objective pursued. A challenge to a prohibition decision taken by a Member State under it is a review of a national derogation from a fundamental freedom, where the margin is narrow and the burden sits on the Member State. Nothing said here is about the first; the whole of it is about the second.

What a regulation could do is harmonize the substantive test, so that a national measure fell to be judged against the harmonized standard rather than against the Treaty freedom directly. It does not do so in the provisions read for this piece. Nothing in Articles 1 to 5, and nothing in the recitals, tells a screening authority what it may prohibit. Articles 19 and 20, which govern assessment criteria and screening decisions, are not read here and are named in the margin as the place that question is answered. Recital 10 points the same way, requiring screening to comply with Articles 49 and 63 TFEU and carrying the Xella threshold across.8 A recital cannot create that constraint and is not being asked to; it is evidence that the legislature did not try to displace it.

A prohibition takes a decision. A nullity does not. That is where the widened trigger actually lands. Nothing here counts how often an authority blocks a deal or fines a buyer, and this column has no such data; the point is structural, which is that in most of these Member States the worst outcome does not wait for anyone to decide anything: an investment made without authorization is void in France, a nullity from the moment of the transaction in Latvia and from conclusion in Lithuania, and concluded under a suspensive condition by operation of law in Austria and Cyprus. Croatia is a fifth shape again: no fines at all, and an order to sell everything within nine months.Conflicts & Capital, By the Numbers, Release 02, rows for France, Latvia, Lithuania, Austria, Cyprus, and Croatia.

It is tempting to say that Xella’s threshold governs the veto and says nothing about the penalty for never asking. The nearest authority is twenty years old, and it is not on all fours. In Burtscher the Court held that Article 56(1) EC, now Article 63 TFEU, precludes national legislation “under which the mere fact that the requisite declaration of acquisition is submitted after the due date results in the retroactive invalidity of the property transaction concerned.” That was a prior-declaration regime for acquisitions, a filing made late, and automatic retroactive nullity, and it did not survive. The regimes listed above are triggered by the absence of any authorization, not by lateness, and a Member State will argue the distance: a formality penalty is one thing and evading a control system is another. And the Member State has an argument Burtscher never faced: the Vorarlberg regime was a national choice, while from January 17, 2028 the authorization requirement in the Article 4(15) sectors is a Union obligation, so what the sanction defends is the effectiveness of Union law. That does not exempt it from proportionality; it moves the case a long way from a land register. Three of the six impose the remedy the Court struck down in terms, France, Latvia, and Lithuania. The other three reach much the same practical place by a different route, a suspensive condition that never lets the transaction take effect, and whether Burtscher reaches that route is itself open. What the case gives a buyer is not an answer. It is that a court has already struck down retroactive invalidity imposed for the lapse of a deadline alone, which is enough to make the sanction contestable rather than settled.9

So both ends are constrained, at different intensities, and that is the useful way to hold this. A prohibition has to clear a demanding substantive test, and what a Member State must show is a genuine and sufficiently serious threat to a fundamental interest of society. A sanction for not filing has an easier justification available, because what is being defended is the effectiveness of a control system the Union now requires rather than a fundamental interest of society. But an easier justification is not an exemption from review, and proportionality is where the sanction is tested. Retroactive invalidity imposed for the lapse of a deadline alone is what Burtscher struck down. The exposure this piece is about is therefore not principally that the deal will be blocked. It is that an unfiled deal can sit for years inside a national nullity rule whose own compatibility with the Treaty is contestable, which is a worse position than either a clearance or a prohibition. On the clear cases the step that avoids it is a filing, and the memo that tells you to make one is cheap; on the arguable cases the memo ends where Article 2 does.

What actually happens is less dramatic than an unwinding and worse to live with. The Regulation says when an authority may open a review and not what it may do in the meantime, and the national instruments in Release 02 answer that. Cyprus bars the investor from exercising any rights in the target, voting and management included, until it complies. Croatia orders the shares sold within nine months, extendable by six, with the rights attaching to them suspended until the sale. Estonia empowers the authority to require transfer of the holding or reversal of the transaction. None of that is a prohibition, and none of it waits for a hearing on whether the deal threatened anything. It is the ordinary consequence of not having asked, and it lands on an asset the buyer is by then running.Conflicts & Capital, By the Numbers, Release 02, rows for Cyprus, Croatia, and Estonia.

The best objection to all of this sits in the same recital. Recital 10 makes “genuine and sufficiently serious threats to a fundamental interest of society” an example of public policy or public security rather than the test of it, and it then lists among the qualifying reasons a risk to “the supply of essential products or services.” That is the currency in which Hungary lost: the Court held that securing the construction sector’s supply of gravel, sand, and clay is not a fundamental interest of society. A Member State now has drafting to point at. It is answered on two grounds. A recital cannot widen a Treaty derogation that Article 52(1) TFEU and the case law construe strictly, and the same recital opens by requiring compliance with Articles 49 and 63 TFEU. And an example is not a substitute for the test: what qualifies as a fundamental interest is still for the Court. But the argument will be run, and it is where the first case under this Regulation is likely to start.

The harder version of the same objection is not about the recital’s wording at all. It is that the Regulation hands a Member State Union-sourced justification without ever writing a standard. Article 4(15) does not merely widen review, it compels a prior authorization requirement in named sectors, so a Member State imposing one is discharging a Union obligation rather than exercising a national choice. And recital 10 is not silent on the ground of decision: it lists the reasons of public policy and public security that qualify. Neither of those two carries a substantive standard on its own. A prior-authorization obligation fixes the trigger and not the outcome; a recital’s list is not a standard against which a prohibition is measured; and Article 4(16) leaves every Member State free to screen beyond the floor on grounds of its own. Whether the Regulation supplies a standard elsewhere is a question for Articles 19 and 20, which govern assessment criteria and screening decisions and are not read here, and the answer to it moves the margin in one direction or the other. What does not depend on it is the Treaty constraint itself: Articles 49 and 63 TFEU apply to a screening decision whatever the Regulation says about the grounds for taking one, and recital 10 says so.

Control, not the certificate of incorporation, now draws the clearance map. The consequence is not simply that more deals are on it. It is that a deal drawn onto the map by the look-through, and then left unfiled because the deal team used the old map, comes off the clock with a five-year ceiling and joins the clock that has none.

The deal has not merely been added to the clearance map. It has been put on the one clock the Regulation gives no end, by a diligence step nobody took.

The clock the filing decision picks

The Regulation runs two of them, and only one has an end.

the sector list decides which bar; the filing decides whether either runs Not subject to prior authorization: art. 4(4) Subject to it, unfiled or filed late: art. 4(5) 15-month floor Member State may extend, to a five-year maximum 24-month floor no maximum in the Regulation and no drawn end Your survival period sits somewhere on this axis. Completion Yr 1 Yr 2 Yr 3 Yr 4 Yr 5
Both bars are drawn from Reg (EU) 2026/1386, arts. 4(4) and 4(5). Note which deal is which, because it is the opposite of what the numbers suggest: art. 4(4), with the five-year ceiling, governs the investment that never needed a filing, and art. 4(5), with no stated maximum, governs the one that needed a filing and did not make it. The bar with the higher floor is the bar with no roof. A third case is on neither bar: a deal subject to the requirement that was notified before completion and cleared leaves both articles behind, and what remains is whatever the national mechanism provides for reopening a clearance. Measured against what Member States have today, the ceiling in the first bar looks like a contraction for fifteen of the 27, and the One Number below says why it reaches far fewer and the floor in the second changes nothing for any of them, which is set out row by row in Release 02.

Also this month

Merger control

The $55 billion take-private of Electronic Arts by PIF, Silver Lake and Affinity Partners closed on August 4, 2026. The European Commission received the merger notification on June 16, 2026 (Case M.12213). Electronic Arts reported on July 30, 2026 that every regulatory approval required to complete the merger had been obtained, which is where the fact of clearance comes from here; the clearance decision itself was not on the Commission’s public case register when this was checked, and the specific date of July 23, 2026 rests on press reporting alone. The deal was also filed under the Foreign Subsidies Regulation.3 merger control and the subsidies regime each asked a question about the buyer’s state capital, whatever foreign-investment screening asked is not on any public record, and none of them addressed whose law governs a player-data claim after closing.

Foreign investment

Regulation (EU) 2026/1386 entered into force on July 16, 2026 and applies from January 17, 2028, repealing Regulation (EU) 2019/452.1 screening becomes mandatory in all 27 Member States, and the look-through to the acquirer’s ultimate control stops being an anti-abuse rule and becomes part of the definition. Under Regulation (EU) 2019/452 the EU-incorporated acquirer sat outside the Union regime’s scope, and the only Union route to it was the duty in art. 3(6) on Member States that already had a mechanism to prevent circumvention, which recital 10 confines to artificial arrangements that do not reflect economic reality. Xella says both halves: the scope of the 2019 Regulation was not extended to a Member-State undertaking under third-country majority control, and nothing in that file suggested circumvention.8

Enforcement

The 2019 Hague Judgments Convention entered into force for Albania and Montenegro on March 1, 2026 and for Andorra on June 1, 2026.4 the enforcement map is widening, but the United States signed in 2022 and has not ratified, so where the assets sit still decides whether a judgment is worth anything.

Technology and AI

The AI Act’s Article 50 transparency obligations began to apply on August 2, 2026, and on the same date the AI Act was added to Annex I of the Representative Actions Directive as point 68.5 an alleged AI Act breach is now a basis for a representative action where it harms the collective interests of consumers, and a qualified entity designated in advance in one Member State for cross-border actions can bring it before the courts of another. Providers whose systems were already placed on the market before August 2, 2026 have until December 2, 2026 to meet the Article 50(2) marking duty, under a four-month transition inserted into the AI Act by the Digital Omnibus.

One Number
24 months, no maximum
The minimum period Article 4(5) requires a Member State to give its screening authority over an investment that was subject to a prior authorization requirement and was not filed, or was filed after completion. For that case the Regulation fixes no outer limit at all.
Source: Reg (EU) 2026/1386, art. 4(5), read in the text. All 27 Member States already meet or exceed the 24-month floor, so the provision adds nothing to any of them, and it takes nothing away either: there is no ceiling in it. The ceiling sits in Article 4(4), which is confined to an investment not subject to a prior authorization requirement. How many of the 27 that ceiling actually contracts is not resolved by this release. Sixteen carry no outer limit today, but the file does not classify each untimed power onto the Article 4(4) track, and on the cells as published only Bulgaria, Romania, and Sweden record a power that is not conditioned on a missing filing, with Lithuania’s reading either way. See By the Numbers, Release 02.

Cite this piece

Eric Martin, Foreign by Control: When the Buyer’s Passport Stops Mattering, Conflicts & Capital (Aug. 20, 2026), https://conflictsandcapital.netlify.app/brief/foreign-by-control.

Also in this issue, a Cornerstone: What Rome II Does to Your Governing-Law Clause ↗

Notes

  1. Regulation (EU) 2026/1386 of the European Parliament and of the Council of 17 June 2026 on the screening of foreign investments in the Union and repealing Regulation (EU) 2019/452, OJ L, 2026/1386, 26.6.2026. Legal basis: Articles 114 and 207(2) TFEU. On the dates: art. 3(1) requires each Member State to establish a screening mechanism, and art. 3(2) requires notification of the implementing measures to the Commission “by 17 January 2028”; recital 66 states that the Regulation “should start to apply 18 months from its date of entry into force” and that Regulation (EU) 2019/452 continues to apply to foreign direct investments undergoing screening on, or completed by, the date of application. EUR-Lex ↗ ↩
  2. Reg (EU) 2026/1386, art. 4(4): screening authorities must be empowered to act on their own initiative, for at least 15 months and up to a maximum of five years after completion, over a foreign investment within the scope of the national mechanism and not subject to a prior authorization requirement, where they have grounds to consider it may affect security or public order. Art. 4(5): at least 24 months, with no stated maximum, where the investment was subject to a prior authorization requirement and was not filed, or was filed after completion. EUR-Lex ↗ ↩
  3. Case M.12213, PIF / ELECTRONIC ARTS, prior notification received June 16, 2026, OJ C, 1.7.2026. Completion on August 4, 2026 per Electronic Arts Inc., Form 8-K filed August 4, 2026, and the parties’ announcements of the same date; the 8-K of July 30, 2026 records that all regulatory approvals required to complete the merger had been obtained. The Commission’s clearance decision was not on the public case register when this piece was checked. That clearance was given is taken from the Form 8-K of July 30, 2026 recording that all required regulatory approvals had been obtained; the date of July 23, 2026 rests on press reporting alone and has not been confirmed against the register. CFIUS does not publish its decisions and is not named in the filings. ↩
  4. Convention of 2 July 2019 on the Recognition and Enforcement of Foreign Judgments in Civil or Commercial Matters. Entry into force per the HCCH status table for Convention No. 41; the United States signed on March 2, 2022 and has not ratified. HCCH status table ↗ ↩
  5. Regulation (EU) 2024/1689 (Artificial Intelligence Act), art. 113 (Chapter IV applies from August 2, 2026) and art. 110, adding the Act to Annex I of Directive (EU) 2020/1828 as point 68. Directive (EU) 2020/1828, arts. 2(1), 4(3) and 6(1): a representative action requires harm to the collective interests of consumers, and only a qualified entity designated in advance in another Member State for cross-border actions may sue there. On the four-month transitional period for systems already placed on the market before August 2, 2026, art. 111(4) of Regulation (EU) 2024/1689 as inserted by Regulation (EU) 2026/1744 (Digital Omnibus on AI), OJ L, 2026/1744, 24.7.2026, explained at recital 38. EUR-Lex ↗ ↩
  6. Reg (EU) 2026/1386, art. 2, point (1): a foreign investment is “an investment of any kind, carried out either by a foreign investor itself or through a foreign investor’s subsidiary in the Union, aiming to establish or to maintain lasting and direct links between the foreign investor and a Union target, to which the foreign investor makes capital available in order to carry out an economic activity in a Member State, enabling effective participation in the management or control of that Union target”; art. 2, point (7): a foreign investor’s subsidiary in the Union is “an undertaking which is established under the laws of a Member State and directly or indirectly controlled by a foreign investor”; art. 2, point (5): a foreign investor is “(a) a natural person who does not hold the nationality of a Member State; or (b) an undertaking or entity established or otherwise organised under the laws of a third country”. Article 2 was read in full and runs to twenty-two numbered points, in the Official Journal’s own order and spelling: “foreign investment”; “greenfield investment”; “internal restructuring”; “request for authorisation”; “foreign investor”; “beneficial owner”; “foreign investor’s subsidiary in the Union”; “opaque ownership structure”; “Union target”; “filing”; “host Member State”; “screening”; “screening mechanism”; “screening decision”; “screening authority”; “completion”; “notifying Member State”; “multi-country transaction”; “multi-country notification”; “mitigating measure”; “contact point”; and “stockpiling”. None of them is “control”. Point (6) defines a beneficial owner as, among others, a natural person “who, directly or indirectly, own or control a foreign investor or Union target” or “on whose behalf the control over that foreign investment is exercised”. EUR-Lex ↗ ↩
  7. Reg (EU) 2019/452, art. 3(1): Member States “may maintain, amend or adopt mechanisms to screen foreign direct investments in their territory”. Reg (EU) 2026/1386, art. 3(1): “Each Member State shall establish a screening mechanism in accordance with this Regulation.” Art. 4(15) lists the cases in which a Member State must impose a prior authorization requirement, by reference to Annex I to Regulation (EU) 2021/821, the Annex to Directive 2009/43/EC, Annex I to Regulation (EU) 2026/1386 itself for semiconductor, quantum and artificial-intelligence technologies, an annex described here only by the words of the cross-reference, Annex I not having been read for this piece, a risk-based assessment of critical transport, energy and digital infrastructure, Section I of Annex I to Regulation (EU) 2024/1252, named financial-market infrastructures, and electoral systems. Art. 4(16) permits Member States to go beyond that list; art. 4(17) disapplies art. 4(15) to greenfield investments. EUR-Lex ↗ ↩
  8. Case C-106/22, Xella Magyarország, ECLI:EU:C:2023:568, paras. 44 to 48 (an undertaking formed under the law of a Member State is an EU company for the purposes of freedom of establishment, and “it does not follow from any provision of EU law that the origin of the shareholders… affects the right of those companies to rely on freedom of establishment”), paras. 66 and 67 (grounds of public policy and public security are derogations from a fundamental freedom and must be interpreted strictly; and, as to an objective linked to security of supply specifically, that it “may be relied on only if there is a genuine and sufficiently serious threat to a fundamental interest of society”) and paras. 41 to 43 and 49 (the case falls to be examined solely under freedom of establishment, not under the free movement of capital), and paras. 37 to 39 (the assessment factor in art. 4(2)(a) relates only to the ownership structure of a “foreign investor” as defined in art. 2(2), so it “does not mean that the scope of that regulation, as defined in Article 1(1) thereof, is extended to include investments made by undertakings organised in accordance with the laws of a Member State over which an undertaking of a third country has majority control”; and nothing in the file suggested a decision taken to counter circumvention within art. 3(6), whose scope recital 10 clarifies as “investments from within the Union by means of artificial arrangements that do not reflect economic reality… where the investor is ultimately owned or controlled by a natural person or an undertaking of a third country”). Reg (EU) 2019/452, art. 3(6) (“Member States which have a screening mechanism in place shall maintain, amend or adopt measures necessary to identify and prevent circumvention of the screening mechanisms and screening decisions”) and recital 10. Reg (EU) 2026/1386, recital 10: screening “should comply with Union law, and in particular with Articles 49 and 63 TFEU”, and any restriction resulting from it “should be justified by reasons of public policy or public security, including genuine and sufficiently serious threats to a fundamental interest of society”. EUR-Lex ↗ ↩
  9. Case C-213/04, Burtscher v. Stauderer, judgment of 1 December 2005, operative part: “Article 56(1) EC precludes the application of national legislation such as the Vorarlberg Land Transfer Law (Vorarlberger Grundverkehrsgesetz) of 23 September 1993, in its amended version, under which the mere fact that the requisite declaration of acquisition is submitted after the due date results in the retroactive invalidity of the property transaction concerned.” The regime in issue was a prior-declaration requirement for the acquisition of land, and the sanction was automatic retroactive nullity on a late filing, irrespective of the reason for the delay. Article 56(1) EC is now Article 63 TFEU. The case is on the sanction, not on the prohibition, which is why it and not Xella is the authority the text turns to. It is not on all fours: the declaration in Burtscher was filed late, and the regimes the text lists are triggered by the absence of any authorization. Nothing in this judgment decides that case, and the text does not say it does. EUR-Lex ↗ ↩

Get The Brief

Each new issue on the private international law of cross-border deals.

Your address is used only to send the column, and you can unsubscribe at any time. Privacy statement ↗