Pursuant to the Foreign Trade and Payments Act (Außenwirtschaftsgesetz – AWG) and the Foreign Trade and Payments Ordinance (Außenwirtschaftsverordnung – AWV), investments into German entities may be subject to the review of the German foreign investment review laws framework. Investments into entities operating in specific, particularly sensitive, business areas, such as for example the operation of critical infrastructure, may be subject to a notification and clearance requirement.
The legislative act specifying what qualifies as critical infrastructure in Germany and what does not has recently been changed thus affecting the German foreign investment review regulatory framework. The Ordinance on the Designation of Critical Infrastructures pursuant to the Act on the Federal Office for Information Security (BSI-KritisV) sets out specific thresholds for the definition of critical infrastructure in the areas of energy, water, food, IT and telecommunications, health, finance and insurance, or transport and traffic.
On September 6, 2021, the German Federal Government has amended the BSI-KritisV with the amendments coming into force on January 1, 2022. The scope of entities that were considered to qualify as operators of or forming part of critical infrastructure has significantly been expanded. While the BSI-KritisV initially covered around 1,600 critical infrastructure operators, s it now covers an estimated 270 additional operators because of the latest amendment. The most recent amendment followed a periodic evaluation conducted by German Government, the latest of which has revealed a need for adjustment of the regulation with respect in particular to the designation of individual facility categories, measurement criteria, and thresholds.
The key amendments of the BSI-KritisV equally affecting the domestic foreign investment review regime are the following:
Software and IT services: Prior to the amendment of the BSI-KritisV, only entities developing or producing software could qualify as operators of critical infrastructure. Now, software and IT-services necessary for providing critical services are regarded “facilities” within the meaning of the BSI-KritisV. As a result, entities which themselves do neither develop nor produce software but merely use software / IT-services necessary for the operation of critical infrastructure may now qualify as operators of critical infrastructure.
Energy sector: The amendment of the BSI-KritisV comes with significant implications for the energy sector. Besides lowering the threshold for certain categories of facilities, the latest reform introduces additional categories. In Annex 1 to the BSI-KritisV, the threshold for power generation plants qualifying as critical infrastructure is lowered from 420 MW to 104 MW installed net nominal capacity, i.e. the average installed net nominal capacity of all gas-fired power plants in Germany. Due to their importance for power supply stability, the threshold for power plants prequalified for the provision of frequency containment reserve is significantly lower, namely 36 MW installed net nominal capacity. The following types of facilities are introduced as new categories of critical infrastructure in the energy sector:
- gas trading systems with a threshold of 5,190 GWh energy of traded gas volumes or capacities per year;
- gas border transfer points, i.e. network points between a German transmission system and that of another country, with a threshold of 5,190 GWh passing per year;
- facilities or system of aggregators for the distribution of fuel and heating oil with 420,000 tons of fuel; 63,750 tons of aviation fuel; or 620,000 tons of heating oil distributed per year; and
- facilities or system engaged in centralized commercial control of mineral oil trade (including but not limited to cloud-based collaboration solutions) handling 4.4 mio. tons of petroleum per year or handling (aviation) fuel or heating oil in the quantities laid down above.
Water sector: The amendments in the water sector are more limited in comparison. For example, due to their importance for drinking water supply, the definition of extraction facilities (waterworks) is extended to include facilities used for the storage or management of surface water.
Food sector: In the food sector, too, the reform of the BSI-KritisV introduces only minor changes. It has been clarified that facilities or services for centralized control in the food sector include systems located at a common site. Also, the previous wording “non-alcoholic beverages” has been changed to align with Regulation (EU) No 1169/2011 of October 25, 2011 to “beverages other than beverages with an alcohol content of more than 1.2 percent by volume.
Information Technology and Telecommunications: In the IT and telecommunications sector, a number of thresholds have been lowered. For internet exchange points (IXPs), the threshold is lowered to 100 connected autonomous systems on an annual average; for data centres to 3.5 MW (contracted capacity); for server farms (hosting) to 10,000 physical or 15,000 virtual total users. Furthermore, top-level domain name registries are now considered critical infrastructure if they manage or operate more than 250,000 domains.
Health sector: The recent amendment introduces a new category “laboratory information networks”, i.e. networks of facilities or systems providing IT services for diagnosis and therapy control in human medicine for more than one laboratory. Covered IT services include in particular sample transport management, order entry and findings transmission communication, and the operation of laboratory information systems. The relevant threshold is set at 1,500,000 cumulative orders in the network per year.
Finance and Insurance sector: Systems for generating and forwarding orders for trading securities and derivatives to a trading venue have been added to the categories for critical infrastructures in the finance and insurance sector. Trading venues themselves have also been added to the categories for critical infrastructures in the finance and insurance sector. Pursuant to Art. 4 No. 24 of Directive (EU) 2014/65 of May 15, 2014 “trading venue” includes Regulated Markets, Multilateral Trading Facilities and Organized Trading Facilities.
Transportation and traffic sector: In order to align facility categories with those listed in Annex II to Directive (EU) 2016/1148 of July 6, 2016, the existing categories in the transportation and traffic sector were supplemented to include airport and port managing bodies, airline traffic control centers and transshipment facilities in sea and inland ports. Furthermore, in the area of road transport, so-called intelligent transport systems were added. Pursuant to the Act on Intelligent Transport Systems (IVSG), the term refers to systems in which information and communication technologies are used in road transport and at interfaces with other means of transport. Besides setting thresholds for the newly introduced categories, some thresholds for existing categories have been adjusted.
Joint facilities: Multiple facilities connected by an operational nexus are now expressively considered a joint facility if they are collectively necessary to provide the same critical service. This is of importance for the calculation of whether a facility meets the relevant threshold, as the volumes are aggregated in the case of joint facilities. The practical implications for investors and companies selling business or entities in Germany is that additional caution and care should be exercised in order to diligently determine whether or not the target invested in or sold qualifies as critical infrastructure. Under German foreign investment review laws, this qualification triggers a mandatory notification and clearance requirement for the investment, which comes with a closing prohibition sanctioning the closing of such transactions without prior clearance under German criminal law. In order to best meet this regulatory challenges, it must be verified from early on in transactions in Germany, whether or not a mandatory filing before and clearance from the German regulator are required.